ALSA-2024:0965 - Important: unbound security update
Summary
ALSA-2024:0965: Important: unbound security update. Affects python3-unbound versions < 1.16.2-5.el8_9.2. Fixed in 1.16.2-5.el8_9.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. It is used to resolve domain names and perform DNSSEC validation. The package is widely used in various operating systems and applications.
Vulnerability Detail
The vulnerability identified as CVE-2023-50387 in the bind9 component of unbound can cause extreme CPU consumption in the DNSSEC validator. This can lead to performance degradation and potential denial of service. Another vulnerability, CVE-2023-50868, affects the NSEC3 closest encloser proof preparation in bind9, which can exhaust CPU resources. These vulnerabilities can be exploited by an attacker to disrupt DNS resolution and potentially impact the availability of services relying on unbound.
How To Fix
Minimum fixed version
1.16.2-5.el8_9.2
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the security update to mitigate the risk.
Conclusion
The unbound package is vulnerable to two security issues that can result in extreme CPU consumption and exhaustion. To mitigate these vulnerabilities, it is recommended to update the package to version 1.16.2-5.el8_9.2 or later. There are no known workarounds for these vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for python3-unbound →
FAQ
Unbound is a DNS resolver used for domain name resolution and DNSSEC validation.
DNSSEC (Domain Name System Security Extensions) is a set of security extensions for DNS that provides authentication and integrity for DNS responses.
The vulnerabilities can result in extreme CPU consumption and exhaustion, leading to performance degradation and potential denial of service.
You can update the unbound package by using the package manager of your operating system. Ensure that you are using version 1.16.2-5.el8_9.2 or later.
There are no known workarounds for these vulnerabilities. It is crucial to apply the security update to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
