Red Hat Security Advisory: unbound security, bug fix, and enhancement update

Fixed packages 8

Vulnerabilities 11

• Unscored —
  CVE-2019-25032

  Unbound before 1.9.5 allows an integer overflow in the regional allocator via regional_alloc. NOTE: The vendor disputes…

  unbound unbound Debian Ubuntu
  Apr 27, 2021
• Unscored —
  CVE-2019-25034

  Unbound before 1.9.5 allows an integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write. …

  unbound unbound Debian Ubuntu
  Apr 27, 2021
• Unscored —
  CVE-2019-25035

  Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vu…

  unbound unbound Debian Ubuntu
  Apr 27, 2021
• Unscored —
  CVE-2019-25036

  Unbound before 1.9.5 allows an assertion failure and denial of service in synth_cname. NOTE: The vendor disputes that t…

  unbound unbound Debian Ubuntu
  Apr 27, 2021
• Unscored —
  CVE-2019-25037

  Unbound before 1.9.5 allows an assertion failure and denial of service in dname_pkt_copy via an invalid packet. NOTE: T…

  unbound unbound Debian Ubuntu
  Apr 27, 2021
• Unscored —
  CVE-2019-25038

  Unbound before 1.9.5 allows an integer overflow in a size calculation in dnscrypt/dnscrypt.c. NOTE: The vendor disputes…

  unbound unbound Debian Ubuntu
  Apr 27, 2021
• Unscored —
  CVE-2019-25039

  Unbound before 1.9.5 allows an integer overflow in a size calculation in respip/respip.c. NOTE: The vendor disputes tha…

  unbound unbound Debian Ubuntu
  Apr 27, 2021
• Unscored —
  CVE-2019-25040

  Unbound before 1.9.5 allows an infinite loop via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that th…

  unbound unbound Debian Ubuntu
  Apr 27, 2021
• Unscored —
  CVE-2019-25041

  Unbound before 1.9.5 allows an assertion failure via a compressed name in dname_pkt_copy. NOTE: The vendor disputes tha…

  unbound unbound Debian Ubuntu
  Apr 27, 2021
• Unscored —
  CVE-2019-25042

  Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy. NOTE: The vendor disputes that …

  unbound unbound Debian Ubuntu
  Apr 27, 2021
• Unscored —
  CVE-2020-28935

  Local symlink attack in Unbound and NSD

  NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not t…

  NLnet Labs Unbound NSD unbound Debian Ubuntu Azure Linux Alpine
  Dec 7, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1714175
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1842837
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1850460
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1878761
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1954772
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1954778
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1954780
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1954782
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1954794
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1954796
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1954797
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1954799
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1954801
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1954804
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1853.json
• report
  https://access.redhat.com/security/cve/CVE-2019-25032
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-25032
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-25032
• report
  https://access.redhat.com/security/cve/CVE-2019-25034
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-25034
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-25034
• report
  https://access.redhat.com/security/cve/CVE-2019-25035
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-25035
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-25035
• report
  https://access.redhat.com/security/cve/CVE-2019-25036
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-25036
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-25036
• report
  https://access.redhat.com/security/cve/CVE-2019-25037
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-25037
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-25037
• report
  https://access.redhat.com/security/cve/CVE-2019-25038
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-25038
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-25038
• report
  https://access.redhat.com/security/cve/CVE-2019-25039
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-25039
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-25039
• report
  https://access.redhat.com/security/cve/CVE-2019-25040