Veracode Vulnerability DatabaseVERACODE:36617Remote Code Execution
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
28.0%
unbound is vulnerable to remote code execution. Malicious users is able to trigger continued resolvability of malicious domain names, even after their revocation from the parent zone, via a novel type of the ghost domain names attack that targets child-centric DNS resolvers.
References
lists.debian.org/debian-lts-announce/2023/03/msg00024.html
lists.fedoraproject.org/archives/list/[email protected]/message/5L3ZFWZZFPBIL654BG75RWXUMPFQJ5EC/
lists.fedoraproject.org/archives/list/[email protected]/message/D35CX4SCZVNKZTWJXPDFTHWZHINMGEZD/
secdb.alpinelinux.org/edge/main.yaml
security.gentoo.org/glsa/202212-02
www.nlnetlabs.nl/downloads/unbound/CVE-2022-30698_CVE-2022-30699.txt
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
28.0%