CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
88.8%
Package : unbound1.9
Version : 1.9.0-2+deb10u2~deb9u1
CVE ID : CVE-2020-12662 CVE-2020-12663 CVE-2020-28935
Debian Bug : 977165
Several security vulnerabilities have been corrected in unbound, a
validating, recursive, caching DNS resolver. Support for the unbound DNS server
has been resumed, the sources can be found in the unbound1.9 source package.
CVE-2020-12662
Unbound has Insufficient Control of Network Message
Volume, aka an "NXNSAttack" issue. This is triggered by random
subdomains in the NSDNAME in NS records.
CVE-2020-12663
Unbound has an infinite loop via malformed DNS answers received from
upstream servers.
CVE-2020-28935
Unbound contains a local vulnerability that would allow for a local symlink
attack. When writing the PID file Unbound creates the file if it is not
there, or opens an existing file for writing. In case the file was already
present, it would follow symlinks if the file happened to be a symlink
instead of a regular file.
For Debian 9 stretch, these problems have been fixed in version
1.9.0-2+deb10u2~deb9u1.
We recommend that you upgrade your unbound1.9 packages.
For the detailed security status of unbound1.9 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/unbound1.9
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: This is a digitally signed message part
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 9 | amd64 | unbound | <Â 1.9.0-2+deb10u2~deb9u1 | unbound_1.9.0-2+deb10u2~deb9u1_amd64.deb |
Debian | 10 | i386 | unbound-host | <Â 1.9.0-2+deb10u3 | unbound-host_1.9.0-2+deb10u3_i386.deb |
Debian | 10 | armhf | libunbound8 | <Â 1.9.0-2+deb10u3 | libunbound8_1.9.0-2+deb10u3_armhf.deb |
Debian | 10 | arm64 | libunbound-dev | <Â 1.9.0-2+deb10u3 | libunbound-dev_1.9.0-2+deb10u3_arm64.deb |
Debian | 9 | armel | unbound-host | <Â 1.9.0-2+deb10u2~deb9u1 | unbound-host_1.9.0-2+deb10u2~deb9u1_armel.deb |
Debian | 10 | arm64 | unbound-host | <Â 1.9.0-2+deb10u3 | unbound-host_1.9.0-2+deb10u3_arm64.deb |
Debian | 9 | armel | unbound-anchor | <Â 1.9.0-2+deb10u2~deb9u1 | unbound-anchor_1.9.0-2+deb10u2~deb9u1_armel.deb |
Debian | 9 | amd64 | unbound-host | <Â 1.9.0-2+deb10u2~deb9u1 | unbound-host_1.9.0-2+deb10u2~deb9u1_amd64.deb |
Debian | 10 | arm64 | python3-unbound | <Â 1.9.0-2+deb10u3 | python3-unbound_1.9.0-2+deb10u3_arm64.deb |
Debian | 9 | i386 | libunbound8 | <Â 1.9.0-2+deb10u2~deb9u1 | libunbound8_1.9.0-2+deb10u2~deb9u1_i386.deb |
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
88.8%