ALSA-2022:7622 - Moderate: unbound security, bug fix, and enhancement update
Summary
ALSA-2022:7622: Moderate: unbound security, bug fix, and enhancement update. Affects python3-unbound versions < 1.16.2-2.el8. Fixed in 1.16.2-2.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The unbound package is a validating, recursive, and caching DNS or DNSSEC resolver. It provides a secure and reliable way to resolve domain names and ensure the integrity of DNS responses. The package is widely used in various Linux distributions, including AlmaLinux 8.
Vulnerability Detail
This vulnerability, identified as CVE-2022-30698 and CVE-2022-30699, affects the unbound package. It allows malicious users to trigger continued resolvability of malicious domain names, leading to potential security breaches and unauthorized access. The vulnerability has been addressed in the latest version of unbound (1.16.2).
How To Fix
Minimum fixed version
1.16.2-2.el8
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The unbound package has been updated to address the security vulnerability (CVE-2022-30698 and CVE-2022-30699). It is crucial to update the package to the latest version to ensure the security and integrity of DNS resolution. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for python3-unbound →
FAQ
Unbound is a DNS resolver that provides secure and reliable domain name resolution.
The vulnerability allows malicious users to exploit the continued resolvability of malicious domain names, potentially leading to security breaches.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package manifest file (e.g., package-lock.json) and the playground will provide real-time alerts for open-source vulnerabilities.
No specific workaround has been provided for this vulnerability. It is recommended to update the unbound package to the latest version.
You can refer to the CVE pages for CVE-2022-30698 and CVE-2022-30699 for more detailed information about the vulnerability, including its impact and CVSS score.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
