Unbound Security Update: Extreme CPU Consumption and Exhaustion
Summary
ALSA-2024:0977: Important: unbound security update. Affects python3-unbound versions < 1.16.2-3.el9_3.1. Fixed in 1.16.2-3.el9_3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Unbound is a validating, recursive, and caching DNS or DNSSEC resolver. It is responsible for translating domain names into IP addresses and vice versa. Unbound is widely used in various systems and applications to handle DNS queries and ensure secure communication. However, certain versions of Unbound are vulnerable to two critical security issues that can lead to extreme CPU consumption and exhaustion.
Vulnerability Detail
The first vulnerability, identified as CVE-2023-50387, is known as KeyTrap. It can cause extreme CPU consumption in the DNSSEC validator of the bind9 package. This vulnerability can be exploited by an attacker to exhaust system resources and disrupt the normal functioning of the DNS resolver.
The second vulnerability, CVE-2023-50868, involves the preparation of an NSEC3 closest encloser proof. This process can also exhaust CPU resources, leading to a denial-of-service condition. Both vulnerabilities pose a significant risk to the stability and performance of the affected Unbound packages.
How To Fix
Minimum fixed version
1.16.2-3.el9_3.1
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Unbound security update addresses two critical vulnerabilities that can cause extreme CPU consumption and exhaustion. It is crucial to update the affected packages to ensure the stability and security of DNS resolution. Follow the provided steps to apply the necessary updates and protect your system from potential attacks. For further assistance or support in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for python3-unbound →
FAQ
Unbound is a DNS resolver that translates domain names into IP addresses and vice versa. It is responsible for handling DNS queries and ensuring secure communication.
DNSSEC (Domain Name System Security Extensions) is a set of security measures that add cryptographic integrity to the DNS. It helps prevent DNS spoofing and other attacks.
CPU consumption refers to the amount of processing power used by a program or process. Extreme CPU consumption can lead to system slowdowns, unresponsiveness, and resource exhaustion.
These vulnerabilities can be exploited by sending specially crafted DNS queries to the affected Unbound packages. The excessive processing required to handle these queries can result in extreme CPU consumption and exhaustion.
The vulnerabilities can lead to system instability, performance degradation, and denial-of-service conditions. Attackers can exploit these vulnerabilities to disrupt DNS resolution and potentially impact the availability of services relying on Unbound.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
