Moderate: unbound security update
Summary
ALSA-2023:2370: Moderate: unbound security update. Affects python3-unbound versions < 1.16.2-3.el9. Fixed in 1.16.2-3.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The unbound package is a validating, recursive, and caching DNS or DNSSEC resolver. It is responsible for resolving domain names to IP addresses and ensuring the authenticity and integrity of DNS data. Unbound is widely used in various operating systems and applications to provide secure and reliable DNS resolution.
Vulnerability Detail
The vulnerability identified as CVE-2022-3204 affects the unbound package. It is classified as a Non-Responsive Delegation Attack (NRDelegation attack), which can lead to uncontrolled resource consumption. This vulnerability allows an attacker to exploit a flaw in the DNS resolution process, causing the unbound resolver to consume excessive resources, potentially leading to denial of service or other malicious activities. The impact of this vulnerability can vary depending on the specific deployment and configuration of unbound.
How To Fix
Minimum fixed version
1.16.2-3.el9
This is the first release that contains the fix.
sudo dnf update python3-unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update as soon as possible to protect the system from potential attacks.
Conclusion
The unbound security update addresses a moderate vulnerability (CVE-2022-3204) that could lead to uncontrolled resource consumption. It is crucial to update the unbound package to the fixed version to mitigate the risk of potential attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python3-unbound →
FAQ
Unbound is a DNS resolver that provides secure and reliable DNS resolution. It is widely used in various operating systems and applications.
The vulnerability can lead to uncontrolled resource consumption, potentially resulting in denial of service or other malicious activities.
To fix this vulnerability, update the unbound package to version 1.16.2-3.el9 or later.
No, there is no known workaround for this vulnerability. Applying the security update is the recommended solution.
You can find more information about this vulnerability in the CVE page listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for python3-unbound.
