Denial of Service Vulnerability in Unbound Package
Summary
DEBIAN-CVE-2024-1931: NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain code path that can lead to an infinite loop. Affects unbound versions < 1.19.2-1. Fixed in 1.19.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unbound is a validating, recursive, and caching DNS resolver developed by NLnet Labs. It is designed to be secure and efficient, providing DNS services to clients while ensuring data integrity and confidentiality. The package is widely used in various environments, including servers and embedded systems, due to its performance and security features. However, certain versions of Unbound are susceptible to a vulnerability that can lead to denial of service, particularly when specific configuration options are enabled.
Vulnerability Detail
NLnet Labs Unbound versions 1.18.0 through 1.19.1 contain a vulnerability that can cause a denial of service due to an infinite loop in a specific code path. This issue arises when the 'ede: yes' option is used in the configuration, which allows the inclusion of EDE records in responses. When the client's advertised buffer size is smaller than the required space for these records, the code attempts to trim the records but can enter an infinite loop due to an unchecked condition. This vulnerability can severely impact the availability of the DNS service, leading to potential service disruptions.
How To Fix
Minimum fixed version
1.19.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider disabling the 'ede: yes' option in your Unbound configuration file to mitigate the risk of triggering the vulnerability. You can do this by editing the configuration file (usually located at /etc/unbound/unbound.conf) and setting 'ede: no'. After making changes, restart the Unbound service with
sudo systemctl restart unbound'.
Conclusion
The vulnerability in Unbound versions 1.18.0 to 1.19.1 poses a significant risk of denial of service due to an infinite loop condition. It is crucial for users to update to version 1.19.2 or later to mitigate this risk. For those unable to update immediately, disabling the 'ede: yes' option serves as a temporary workaround.
See every vulnerability recorded for unbound →
FAQ
The vulnerability can lead to a denial of service, causing the DNS resolver to become unresponsive and potentially disrupt services relying on DNS.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Unbound versions 1.18.0 through 1.19.1 are affected by this vulnerability.
Yes, updating to Unbound version 1.19.2 or later resolves the vulnerability.
As a temporary measure, disable the 'ede: yes' option in your Unbound configuration to prevent the vulnerability from being triggered.
References
Related vulnerabilities
Recent vulnerabilities recorded for unbound.
