Important: unbound security update
Summary
ALSA-2024:1750: Important: unbound security update. Affects python3-unbound versions < 1.16.2-3.el9_3.5. Fixed in 1.16.2-3.el9_3.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The unbound package is a validating, recursive, and caching DNS or DNSSEC resolver. It is responsible for resolving domain names and ensuring the security and integrity of DNS queries. Unbound is widely used in various systems and applications to provide reliable and secure DNS resolution.
Vulnerability Detail
A vulnerability has been discovered in Unbound that allows any process outside the unbound group to modify the unbound runtime configuration. This vulnerability arises from incorrect default permissions and the combination of certain configuration options. An unprivileged local process can connect over localhost to port 8953 and alter the configuration of unbound.service. This flaw enables the manipulation of a running instance, potentially disrupting resolving and allowing unauthorized access to forwarded queries.
How To Fix
Minimum fixed version
1.16.2-3.el9_3.5
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If the configuration is vulnerable, the following steps can be taken to fix it:
- Add the line "include:/etc/unbound/conf.d/remote-control.conf" to the end of the file "/etc/unbound/unbound.conf".
- If a custom "/etc/unbound/conf.d/remote-control.conf" file is used, add the new directives (control-interface and control-use-cert) to this file.
Conclusion
The vulnerability in Unbound can be addressed by updating to the latest version and applying the recommended configuration changes. It is important to verify the configuration and ensure that the vulnerability is mitigated. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python3-unbound →
FAQ
The vulnerability allows an unprivileged local process to manipulate a running instance of Unbound, potentially disrupting DNS resolving and enabling unauthorized access to forwarded queries.
You can use the command "unbound-control status | grep control" and check if the output contains "control(ssl)" or "control(namedpipe)". If it returns only "control", your configuration is vulnerable.
The remote-control.conf file limits access to the main unbound configuration file, unbound.conf, by including the control-interface and control-use-cert directives. It helps mitigate the vulnerability by enforcing access restrictions.
You can update to the latest version of unbound by following the instructions provided by your operating system or package manager. It is recommended to install the version mentioned in the advisory to address the vulnerability.
The recommended workaround is to update to the latest version of unbound and apply the necessary configuration changes. This ensures the vulnerability is properly mitigated.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
