kritisch
CVE-2019-25042
unbound: out-of-bounds write via a compressed name in rdata_copy
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Photon OS. Niedriger laut Red Hat (mittel), Amazon (mittel), Oracle (mittel), Rocky Linux (mittel), Ubuntu (mittel).
Beschreibung
Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 1.0 | unbound | 1.6.8-4.ph1 |
| Photon OS 2.0 | unbound | 1.6.8-4.ph2 |
| Photon OS 3.0 | unbound | 1.13.1-1.ph3 |
| Photon OS 5.0 | unbound, unbound-devel, unbound-docs | 1.26.0-1.ph5 |
| amazon linux 2 | python2-unbound, python3-unbound, unbound und 3 weitere | 1.7.3-15.amzn2.0.1 |
| debian 11 | unbound | 1.9.6-1 |
| debian 12 | unbound | 1.9.6-1 |
| debian 13 | unbound | 1.9.6-1 |
| debian 14 | unbound | 1.9.6-1 |
| debian 9 | unbound, unbound1.9 | 1.9.0-2+deb10u2~deb9u2 |
| echo | unbound | 1.9.6-1 |
| Oracle Linux 8 | python3-unbound, unbound, unbound-devel und 1 weitere | 1.7.3-15.el8 |
Alle 35 Einträge aus 18 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 1.0 | unbound | 1.6.8-4.ph1 |
| Photon OS 2.0 | unbound | 1.6.8-4.ph2 |
| Photon OS 3.0 | unbound | 1.13.1-1.ph3 |
| Photon OS 5.0 | unbound | 1.26.0-1.ph5 |
| Photon OS 5.0 | unbound-devel | 1.26.0-1.ph5 |
| Photon OS 5.0 | unbound-docs | 1.26.0-1.ph5 |
| amazon linux 2 | python2-unbound | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | python3-unbound | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | unbound | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | unbound-debuginfo | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | unbound-devel | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | unbound-libs | 1.7.3-15.amzn2.0.1 |
| debian 11 | unbound | 1.9.6-1 |
| debian 12 | unbound | 1.9.6-1 |
| debian 13 | unbound | 1.9.6-1 |
| debian 14 | unbound | 1.9.6-1 |
| debian 9 | unbound | kein Fix angegeben |
| debian 9 | unbound1.9 | 1.9.0-2+deb10u2~deb9u2 |
| echo | unbound | 1.9.6-1 |
| Oracle Linux 8 | python3-unbound | 1.7.3-15.el8 |
| Oracle Linux 8 | unbound | 1.7.3-15.el8 |
| Oracle Linux 8 | unbound-devel | 1.7.3-15.el8 |
| Oracle Linux 8 | unbound-libs | 1.7.3-15.el8 |
| Red Hat | unbound | kein Fix angegeben |
| Red Hat | unbound-devel | kein Fix angegeben |
| Red Hat | unbound-libs | kein Fix angegeben |
| Red Hat | unbound-python | kein Fix angegeben |
| rocky 8 | python3-unbound | 1.7.3-15.el8 |
| rocky 8 | unbound | 1.7.3-15.el8 |
| rocky 8 | unbound-devel | 1.7.3-15.el8 |
| rocky 8 | unbound-libs | 1.7.3-15.el8 |
| ubuntu 18.04 | unbound | 1.6.7-1ubuntu2.4 |
| ubuntu 18.04-ESM | unbound | 1.6.7-1ubuntu2.4 |
| ubuntu 20.04 | unbound | 1.9.4-2ubuntu1.2 |
| ubuntu 20.04-ESM | unbound | 1.9.4-2ubuntu1.2 |
Referenzen
- https://access.redhat.com/errata/RHSA-2021:1853
- https://access.redhat.com/security/cve/CVE-2019-25042
- https://bugzilla.redhat.com/show_bug.cgi?id=1714175
- https://bugzilla.redhat.com/show_bug.cgi?id=1842837
- https://bugzilla.redhat.com/show_bug.cgi?id=1850460
- https://bugzilla.redhat.com/show_bug.cgi?id=1878761
- https://bugzilla.redhat.com/show_bug.cgi?id=1954772
- https://bugzilla.redhat.com/show_bug.cgi?id=1954778
Alle 37 Referenzen
- https://bugzilla.redhat.com/show_bug.cgi?id=1954780
- https://bugzilla.redhat.com/show_bug.cgi?id=1954782
- https://bugzilla.redhat.com/show_bug.cgi?id=1954794
- https://bugzilla.redhat.com/show_bug.cgi?id=1954796
- https://bugzilla.redhat.com/show_bug.cgi?id=1954797
- https://bugzilla.redhat.com/show_bug.cgi?id=1954799
- https://bugzilla.redhat.com/show_bug.cgi?id=1954801
- https://bugzilla.redhat.com/show_bug.cgi?id=1954804
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25032
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25034
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25035
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25036
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25037
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25038
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25039
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25040
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25041
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25042
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28935
- https://errata.rockylinux.org/RLSA-2021:1853
- https://linux.oracle.com/cve/CVE-2019-25042.html
- https://linux.oracle.com/errata/ELSA-2021-1853.html
- https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-25042
- https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/
- https://security.netapp.com/advisory/ntap-20210507-0007/
- https://ubuntu.com/security/notices/USN-4938-1
- https://www.cve.org/CVERecord?id=CVE-2019-25042