critique
CVE-2019-25042
unbound: out-of-bounds write via a compressed name in rdata_copy
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, Photon OS. Plus basse selon Red Hat (moyenne), Amazon (moyenne), Oracle (moyenne), Rocky Linux (moyenne), Ubuntu (moyenne).
Description
Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | unbound | 1.6.8-4.ph1 |
| Photon OS 2.0 | unbound | 1.6.8-4.ph2 |
| Photon OS 3.0 | unbound | 1.13.1-1.ph3 |
| Photon OS 5.0 | unbound, unbound-devel, unbound-docs | 1.26.0-1.ph5 |
| amazon linux 2 | python2-unbound, python3-unbound, unbound et 3 autres | 1.7.3-15.amzn2.0.1 |
| debian 11 | unbound | 1.9.6-1 |
| debian 12 | unbound | 1.9.6-1 |
| debian 13 | unbound | 1.9.6-1 |
| debian 14 | unbound | 1.9.6-1 |
| debian 9 | unbound, unbound1.9 | 1.9.0-2+deb10u2~deb9u2 |
| echo | unbound | 1.9.6-1 |
| Oracle Linux 8 | python3-unbound, unbound, unbound-devel et 1 autres | 1.7.3-15.el8 |
Afficher les 35 entrées de 18 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | unbound | 1.6.8-4.ph1 |
| Photon OS 2.0 | unbound | 1.6.8-4.ph2 |
| Photon OS 3.0 | unbound | 1.13.1-1.ph3 |
| Photon OS 5.0 | unbound | 1.26.0-1.ph5 |
| Photon OS 5.0 | unbound-devel | 1.26.0-1.ph5 |
| Photon OS 5.0 | unbound-docs | 1.26.0-1.ph5 |
| amazon linux 2 | python2-unbound | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | python3-unbound | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | unbound | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | unbound-debuginfo | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | unbound-devel | 1.7.3-15.amzn2.0.1 |
| amazon linux 2 | unbound-libs | 1.7.3-15.amzn2.0.1 |
| debian 11 | unbound | 1.9.6-1 |
| debian 12 | unbound | 1.9.6-1 |
| debian 13 | unbound | 1.9.6-1 |
| debian 14 | unbound | 1.9.6-1 |
| debian 9 | unbound | pas de correctif indiqué |
| debian 9 | unbound1.9 | 1.9.0-2+deb10u2~deb9u2 |
| echo | unbound | 1.9.6-1 |
| Oracle Linux 8 | python3-unbound | 1.7.3-15.el8 |
| Oracle Linux 8 | unbound | 1.7.3-15.el8 |
| Oracle Linux 8 | unbound-devel | 1.7.3-15.el8 |
| Oracle Linux 8 | unbound-libs | 1.7.3-15.el8 |
| Red Hat | unbound | pas de correctif indiqué |
| Red Hat | unbound-devel | pas de correctif indiqué |
| Red Hat | unbound-libs | pas de correctif indiqué |
| Red Hat | unbound-python | pas de correctif indiqué |
| rocky 8 | python3-unbound | 1.7.3-15.el8 |
| rocky 8 | unbound | 1.7.3-15.el8 |
| rocky 8 | unbound-devel | 1.7.3-15.el8 |
| rocky 8 | unbound-libs | 1.7.3-15.el8 |
| ubuntu 18.04 | unbound | 1.6.7-1ubuntu2.4 |
| ubuntu 18.04-ESM | unbound | 1.6.7-1ubuntu2.4 |
| ubuntu 20.04 | unbound | 1.9.4-2ubuntu1.2 |
| ubuntu 20.04-ESM | unbound | 1.9.4-2ubuntu1.2 |
Références
- https://access.redhat.com/errata/RHSA-2021:1853
- https://access.redhat.com/security/cve/CVE-2019-25042
- https://bugzilla.redhat.com/show_bug.cgi?id=1714175
- https://bugzilla.redhat.com/show_bug.cgi?id=1842837
- https://bugzilla.redhat.com/show_bug.cgi?id=1850460
- https://bugzilla.redhat.com/show_bug.cgi?id=1878761
- https://bugzilla.redhat.com/show_bug.cgi?id=1954772
- https://bugzilla.redhat.com/show_bug.cgi?id=1954778
Les 37 références
- https://bugzilla.redhat.com/show_bug.cgi?id=1954780
- https://bugzilla.redhat.com/show_bug.cgi?id=1954782
- https://bugzilla.redhat.com/show_bug.cgi?id=1954794
- https://bugzilla.redhat.com/show_bug.cgi?id=1954796
- https://bugzilla.redhat.com/show_bug.cgi?id=1954797
- https://bugzilla.redhat.com/show_bug.cgi?id=1954799
- https://bugzilla.redhat.com/show_bug.cgi?id=1954801
- https://bugzilla.redhat.com/show_bug.cgi?id=1954804
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25032
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25034
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25035
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25036
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25037
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25038
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25039
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25040
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25041
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25042
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28935
- https://errata.rockylinux.org/RLSA-2021:1853
- https://linux.oracle.com/cve/CVE-2019-25042.html
- https://linux.oracle.com/errata/ELSA-2021-1853.html
- https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-25042
- https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/
- https://security.netapp.com/advisory/ntap-20210507-0007/
- https://ubuntu.com/security/notices/USN-4938-1
- https://www.cve.org/CVERecord?id=CVE-2019-25042