Description
An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared to versions of Unbound that shipped before the mentioned erratum. This issue is about the incomplete fix for CVE-2020-12662, and it does not affect upstream versions of Unbound.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | unbound | unbound-1.6.6-5.el7_8 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | unbound +3 | 1.6.6-5.el7_8 | RHSA-2020:2642 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | unbound +3 | 1.6.6-5.amzn2 | ALAS2-2020-1463 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | unbound +3 | 1.6.6-5.el7_8 | ELSA-2020-2642 |
Advisories 3
- RHSA-2020:2642 Red Hat Security Advisory: unbound security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- ALAS2-2020-1463 Important: unbound security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 17, 2020
- ELSA-2020-2642 Important: unbound security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 22, 2020