critique
CVE-2019-25038
unbound: integer overflow in a size calculation in dnscrypt/dnscrypt.c
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, Photon OS. Plus basse selon Red Hat (moyenne), Amazon (moyenne), Oracle (moyenne), Rocky Linux (moyenne), Ubuntu (moyenne).
Description
Unbound before 1.9.5 allows an integer overflow in a size calculation in dnscrypt/dnscrypt.c. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | unbound | 1.13.1-1.ph1 |
| Photon OS 2.0 | unbound | 1.13.1-1.ph2 |
| Photon OS 3.0 | unbound | 1.13.1-1.ph3 |
| Photon OS 5.0 | unbound, unbound-devel, unbound-docs | 1.26.0-1.ph5 |
| amazon linux 2 | python2-unbound, python3-unbound, unbound et 3 autres | 1.7.3-15.amzn2.0.1 |
| debian 11 | unbound | 1.9.6-1 |
| debian 12 | unbound | 1.9.6-1 |
| debian 13 | unbound | 1.9.6-1 |
| debian 14 | unbound | 1.9.6-1 |
| debian 9 | unbound, unbound1.9 | 1.9.0-2+deb10u2~deb9u2 |
| echo | unbound | 1.9.6-1 |
| Oracle Linux 8 | python3-unbound, unbound, unbound-devel et 1 autres | 1.7.3-15.el8 |
Afficher les 35 entrées de 18 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | unbound | 1.13.1-1.ph1 |
| Photon OS 2.0 | unbound | 1.13.1-1.ph2 |
| Photon OS 3.0 | unbound | 1.13.1-1.ph3 |
| Photon OS 5.0 | unbound | 1.26.0-1.ph5 |
| Photon OS 5.0 | unbound-devel | 1.26.0-1.ph5 |
| Photon OS 5.0 | unbound-docs | 1.26.0-1.ph5 |
| amazon linux 2 | python2-unbound | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | python3-unbound | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | unbound | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | unbound-debuginfo | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | unbound-devel | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | unbound-libs | 1.7.3-15.amzn2.0.1 |
| debian 11 | unbound | 1.9.6-1 |
| debian 12 | unbound | 1.9.6-1 |
| debian 13 | unbound | 1.9.6-1 |
| debian 14 | unbound | 1.9.6-1 |
| debian 9 | unbound | pas de correctif indiqué |
| debian 9 | unbound1.9 | 1.9.0-2+deb10u2~deb9u2 |
| echo | unbound | 1.9.6-1 |
| Oracle Linux 8 | python3-unbound | 1.7.3-15.el8 |
| Oracle Linux 8 | unbound | 1.7.3-15.el8 |
| Oracle Linux 8 | unbound-devel | 1.7.3-15.el8 |
| Oracle Linux 8 | unbound-libs | 1.7.3-15.el8 |
| Red Hat | unbound | pas de correctif indiqué |
| Red Hat | unbound-devel | pas de correctif indiqué |
| Red Hat | unbound-libs | pas de correctif indiqué |
| Red Hat | unbound-python | pas de correctif indiqué |
| rocky 8 | python3-unbound | 1.7.3-15.el8 |
| rocky 8 | unbound | 1.7.3-15.el8 |
| rocky 8 | unbound-devel | 1.7.3-15.el8 |
| rocky 8 | unbound-libs | 1.7.3-15.el8 |
| ubuntu 18.04 | unbound | 1.6.7-1ubuntu2.4 |
| ubuntu 18.04-ESM | unbound | 1.6.7-1ubuntu2.4 |
| ubuntu 20.04 | unbound | 1.9.4-2ubuntu1.2 |
| ubuntu 20.04-ESM | unbound | 1.9.4-2ubuntu1.2 |
Références
- https://access.redhat.com/errata/RHSA-2021:1853
- https://access.redhat.com/security/cve/CVE-2019-25038
- https://bugzilla.redhat.com/show_bug.cgi?id=1714175
- https://bugzilla.redhat.com/show_bug.cgi?id=1842837
- https://bugzilla.redhat.com/show_bug.cgi?id=1850460
- https://bugzilla.redhat.com/show_bug.cgi?id=1878761
- https://bugzilla.redhat.com/show_bug.cgi?id=1954772
- https://bugzilla.redhat.com/show_bug.cgi?id=1954778
Les 37 références
- https://bugzilla.redhat.com/show_bug.cgi?id=1954780
- https://bugzilla.redhat.com/show_bug.cgi?id=1954782
- https://bugzilla.redhat.com/show_bug.cgi?id=1954794
- https://bugzilla.redhat.com/show_bug.cgi?id=1954796
- https://bugzilla.redhat.com/show_bug.cgi?id=1954797
- https://bugzilla.redhat.com/show_bug.cgi?id=1954799
- https://bugzilla.redhat.com/show_bug.cgi?id=1954801
- https://bugzilla.redhat.com/show_bug.cgi?id=1954804
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25032
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25034
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25035
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25036
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25037
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25038
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25039
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25040
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25041
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25042
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28935
- https://errata.rockylinux.org/RLSA-2021:1853
- https://linux.oracle.com/cve/CVE-2019-25038.html
- https://linux.oracle.com/errata/ELSA-2021-1853.html
- https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-25038
- https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/
- https://security.netapp.com/advisory/ntap-20210507-0007/
- https://ubuntu.com/security/notices/USN-4938-1
- https://www.cve.org/CVERecord?id=CVE-2019-25038