Summary
[1.16.2-3.5]
- Rebuilt again with z-stream target
[1.16.2-3.4]
- Correct typo in new config file
[1.16.2-3.3]
- Ensure group access correction reaches also updated configs (CVE-2024-1488)
[1.16.2-3.2]
- Ensure only unbound group can change configuration (CVE-2024-1488)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | python3-unbound | 0:1.16.2-3.el9_3.5 |
| Oracle Linux · 9 | unbound | 0:1.16.2-3.el9_3.5 |
| Oracle Linux · 9 | unbound-devel | 0:1.16.2-3.el9_3.5 |
| Oracle Linux · 9 | unbound-libs | 0:1.16.2-3.el9_3.5 |
Vulnerabilities 1
-
High 8.0
Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation
A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbo…