CVE-2019-25033
unbound: integer overflow in the regional allocator via the ALIGN_UP macro
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Photon OS. Más baja según Red Hat (media), Amazon (media), Ubuntu (media).
Descripción
Unbound before 1.9.5 allows an integer overflow in the regional allocator via the ALIGN_UP macro. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 1.0 | unbound | 1.13.1-1.ph1 |
| Photon OS 2.0 | unbound | 1.13.1-1.ph2 |
| Photon OS 3.0 | unbound | 1.13.1-1.ph3 |
| Photon OS 5.0 | unbound, unbound-devel, unbound-docs | 1.26.0-1.ph5 |
| amazon linux 2 | python2-unbound, python3-unbound, unbound y 3 más | 1.7.3-15.amzn2.0.1 |
| debian 11 | unbound | 1.9.6-1 |
| debian 12 | unbound | 1.9.6-1 |
| debian 13 | unbound | 1.9.6-1 |
| debian 14 | unbound | 1.9.6-1 |
| debian 9 | unbound, unbound1.9 | 1.9.0-2+deb10u2~deb9u2 |
| echo | unbound | 1.9.6-1 |
| Red Hat | unbound, unbound-devel, unbound-libs y 1 más | sin corrección indicada |
Mostrar las 27 entradas de 16 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 1.0 | unbound | 1.13.1-1.ph1 |
| Photon OS 2.0 | unbound | 1.13.1-1.ph2 |
| Photon OS 3.0 | unbound | 1.13.1-1.ph3 |
| Photon OS 5.0 | unbound | 1.26.0-1.ph5 |
| Photon OS 5.0 | unbound-devel | 1.26.0-1.ph5 |
| Photon OS 5.0 | unbound-docs | 1.26.0-1.ph5 |
| amazon linux 2 | python2-unbound | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | python3-unbound | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | unbound | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | unbound-debuginfo | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | unbound-devel | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | unbound-libs | 1.7.3-15.amzn2.0.1 |
| debian 11 | unbound | 1.9.6-1 |
| debian 12 | unbound | 1.9.6-1 |
| debian 13 | unbound | 1.9.6-1 |
| debian 14 | unbound | 1.9.6-1 |
| debian 9 | unbound | sin corrección indicada |
| debian 9 | unbound1.9 | 1.9.0-2+deb10u2~deb9u2 |
| echo | unbound | 1.9.6-1 |
| Red Hat | unbound | sin corrección indicada |
| Red Hat | unbound-devel | sin corrección indicada |
| Red Hat | unbound-libs | sin corrección indicada |
| Red Hat | unbound-python | sin corrección indicada |
| ubuntu 18.04 | unbound | 1.6.7-1ubuntu2.4 |
| ubuntu 18.04-ESM | unbound | 1.6.7-1ubuntu2.4 |
| ubuntu 20.04 | unbound | 1.9.4-2ubuntu1.2 |
| ubuntu 20.04-ESM | unbound | 1.9.4-2ubuntu1.2 |
Referencias
- https://access.redhat.com/security/cve/CVE-2019-25033
- https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-25033
- https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/
- https://security.netapp.com/advisory/ntap-20210507-0007/
- https://ubuntu.com/security/notices/USN-4938-1
- https://www.cve.org/CVERecord?id=CVE-2019-25033