Summary
[1.16.2-5.6]
- Rebuilt again with z-stream target
[1.16.2-5.5]
- Correct typo in new config file
[1.16.2-5.4]
- Ensure group access correction reaches also updated configs (CVE-2024-1488)
[1.16.2-5.3]
- Ensure only unbound group can change configuration (CVE-2024-1488)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | python3-unbound | 0:1.16.2-5.el8_9.6 |
| Oracle Linux · 8 | unbound | 0:1.16.2-5.el8_9.6 |
| Oracle Linux · 8 | unbound-devel | 0:1.16.2-5.el8_9.6 |
| Oracle Linux · 8 | unbound-libs | 0:1.16.2-5.el8_9.6 |
Vulnerabilities 1
-
High 8.0
Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation
A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbo…