Every CVE Search/ Get API key

CVE-2020-28935

Local symlink attack in Unbound and NSD

5.5 MediumFix available

NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.49%Down 0.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.5

NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.

Record
CVE-2020-28935
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-59
Updated
2026-11-02
CVE List No score

Local symlink attack in Unbound and NSD

NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.

Record
CVE-2020-28935
Weakness
CWE-59
Updated
2026-11-02
EUVDEUVD-2020-21323 No score

NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.

Record
EUVD-2020-21323
Updated
2026-11-03
GitHub AdvisoriesGHSA-q92f-7cwj-w4w5 5.5

NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including...

NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.

Record
GHSA-q92f-7cwj-w4w5
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-59
Updated
2026-11-02
OSVALPINE-CVE-2020-28935 5.5

NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.

Record
ALPINE-CVE-2020-28935
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-6931 5.5

CVE-2020-28935 affecting package unbound for versions less than 1.10.0-5

NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.

Record
AZL-6931
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 18 moreShow less
OSV 5.5

NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.

Record
CVE-2020-28935
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-28935 5.5

NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.

Record
DEBIAN-CVE-2020-28935
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2021-1054 7.3

unbound security update

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.(CVE-2020-28935)

Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiving a specially crafted answer. This issue can only be triggered if unbound was compiled with --enable-ipsecmod support, and ipsecmod is enabled and used in the configuration.(CVE-2019-18934)

Record
OESA-2021-1054
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVOESA-2021-1083 5.5

unbound security update

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.(CVE-2020-28935)

Record
OESA-2021-1083
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:1853 9.8

Red Hat Security Advisory: unbound security, bug fix, and enhancement update

Record
RHSA-2021:1853
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0632 9.8

Red Hat Security Advisory: unbound security update

Record
RHSA-2022:0632
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2021:1853 9.8

Moderate: unbound security, bug fix, and enhancement update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

  • unbound: integer overflow in the regional allocator via regional_alloc (CVE-2019-25032)

  • unbound: integer overflow in sldns_str2wire_dname_buf_origin can lead to an out-of-bounds write (CVE-2019-25034)

  • unbound: out-of-bounds write in sldns_bget_token_par (CVE-2019-25035)

  • unbound: assertion failure and denial of service in synth_cname (CVE-2019-25036)

  • unbound: assertion failure and denial of service in dname_pkt_copy via an invalid packet (CVE-2019-25037)

  • unbound: integer overflow in a size calculation in dnscrypt/dnscrypt.c (CVE-2019-25038)

  • unbound: integer overflow in a size calculation in respip/respip.c (CVE-2019-25039)

  • unbound: infinite loop via a compressed name in dname_pkt_copy (CVE-2019-25040)

  • unbound: assertion failure via a compressed name in dname_pkt_copy (CVE-2019-25041)

  • unbound: out-of-bounds write via a compressed name in rdata_copy (CVE-2019-25042)

  • unbound: symbolic link traversal when writing PID file (CVE-2020-28935)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.

Record
RLSA-2021:1853
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-28935 5.5

NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.

Record
UBUNTU-CVE-2020-28935
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2021-0154 No score

Updated unbound packages fix a security vulnerability

Unbound contains a local vulnerability that would allow for a local symlink attack. When writing the PID file Unbound creates the file if it is not there, or opens an existing file for writing. In case the file was already present, it would follow symlinks if the file happened to be a symlink instead of a regular file (CVE-2020-28935).

Record
MGASA-2021-0154
Updated
2026-11-02
OSVopenSUSE-SU-2020:2222-1 No score

Security update for nsd

This update for nsd fixes the following issues:

nsd was updated to the new upstream release 4.3.4

FEATURES:

  • Merge PR #141: ZONEMD RR type.

BUG FIXES:

  • Fix that symlink does not interfere with chown of pidfile (boo#1179191, CVE-2020-28935)
  • Fix #128: Fix that the invalid port number is logged for sendmmsg failed: Invalid argument.
  • Fix #133: fix 0-init of local ( stack ) buffer.
  • Fix #134: IPV4_MINIMAL_RESPONSE_SIZE vs EDNS_MAX_MESSAGE_LEN.
  • Fix to add missing closest encloser NSEC3 for wildcard nodata type DS answer.
  • Fix #138: NSD returns non-EDNS answer when QUESTION is empty.
  • Fix #142: NODATA answers missin SOA in authority section after CNAME chain.

New upstream release 4.3.3:

FEATURES:

  • Follow DNS flag day 2020 advice and set default EDNS message size to 1232.

  • Merged PR #113 with fixes. Instead of listing an IP-address to listen on, an interface name can be specified in nsd.conf, with ip-address: eth0. The IP-addresses for that interface are then used.

  • New upstream release 4.3.2

FEATURES:

  • Fix #96: log-only-syslog: yes sets to only use syslog, fixes that the default configuration and systemd results in duplicate log messages.
  • Fix #107: nsd -v shows configure line, openssl version and libevent version.
  • Fix #103 with #110: min-expire-time option. To provide a lower bound for expire period. Expressed in number of seconds or refresh+retry+1.

BUG FIXES:

  • Fix to omit the listen-on lines from log at startup, unless verbose.
  • Fix #97: EDNS unknown version: query not in response.
  • Fix #99: Fix copying of socket properties with reuseport enabled.
  • Document default value for tcp-timeout.
  • Merge PR#102 from and0x000: add missing default in documentation for drop-updates.
  • Fix unlink of pidfile warning if not possible due to permissions, nsd can display the message at high verbosity levels.
  • Removed contrib/nsd.service, example is too complicated and not useful.
  • Merge #108 from Nomis: Make the max-retry-time description clearer.
  • Retry when udp send buffer is full to wait until buffer space is available.
  • Remove errno reset behaviour from sendmmsg and recvmmsg replacement functions.
  • Fix unit test for different nsd-control-setup -h exit code.
  • Merge #112 from jaredmauch: log old and new serials when NSD rejects an IXFR due to an old serial number.
  • Fix #106: Adhere better to xfrd bounds. Refresh and retry times.
  • Fix #105: Clearing hash_tree means just emptying the tree.

New upstream release 4.3.1

BUG FIXES:

  • Merge PR #91 by gearnode: nsd-control-setup recreate certificates. The '-r' option recreates certificates. Without it it creates them if they do not exist, and does not modify them otherwise.

New upstream release 4.3.0

FEATURES:

  • Fix to use getrandom() for randomness, if available.
  • Fix #56: Drop sparse TSIG signing support in NSD. Sign every axfr packet with TSIG, according to the latest draft-ietf-dnsop-rfc2845bis-06, Section 5.3.1.
  • Merge pull request #59 from buddyns: add FreeBSD support for conf key ip-transparent.
  • Add feature to pin server processes to specific cpus.
  • Add feature to pin IP addresses to selected server processes.
  • Set process title to identify individual processes.
  • Merge PR#22: minimise-any: prefer polular and not large RRset, from Daisuke Higashi.
  • Add support for SO_BINDTODEVICE on Linux.
  • Add feature to drop queries with opcode UPDATE.

BUG FIXES:

  • Fix whitespace in nsd.conf.sample.in, patch from Paul Wouters.

  • use-systemd is ignored in nsd.conf, when NSD is compiled with libsystemd it always signals readiness, if possible.

  • Note that use-systemd is not necessary and ignored in man page.

  • Fix responses for IXFR so that the authority section is not echoed in the response.

  • Fix that the retry wait does not exceed one day for zone transfers.

  • Update keyring as per https://nlnetlabs.nl/people/

New upstream release 4.2.3:

  • confine-to-zone configures NSD to not return out-of-zone …
Record
openSUSE-SU-2020:2222-1
Updated
2026-11-02
OSVopenSUSE-SU-2022:0176-1 No score

Security update for unbound

This update for unbound fixes the following issues:

  • CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).
  • CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).
  • CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).
  • CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).
  • CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).
  • CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).
  • CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).
  • CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).
  • CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).
  • CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).
  • CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).
  • CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).
  • CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).
Record
openSUSE-SU-2022:0176-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11005-1 No score

libunbound8-1.13.2-1.2 on GA media

These are all security issues fixed in the libunbound8-1.13.2-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11005-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11100-1 No score

nsd-4.3.7-1.2 on GA media

These are all security issues fixed in the nsd-4.3.7-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11100-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15069-1 No score

sslh-2.2.3-1.1 on GA media

These are all security issues fixed in the sslh-2.2.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15069-1
Updated
2026-11-02
OSVSUSE-SU-2022:0176-1 No score

Security update for unbound

This update for unbound fixes the following issues:

  • CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).
  • CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).
  • CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).
  • CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).
  • CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).
  • CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).
  • CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).
  • CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).
  • CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).
  • CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).
  • CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).
  • CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).
  • CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).
Record
SUSE-SU-2022:0176-1
Updated
2026-11-02
OSVSUSE-SU-2022:0176-2 No score

Security update for unbound

This update for unbound fixes the following issues:

  • CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).
  • CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).
  • CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).
  • CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).
  • CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).
  • CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).
  • CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).
  • CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).
  • CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).
  • CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).
  • CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).
  • CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).
  • CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).
Record
SUSE-SU-2022:0176-2
Updated
2026-11-02
OSVSUSE-SU-2022:0301-1 No score

Security update for unbound

This update for unbound fixes the following issues:

  • CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).
  • CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).
  • CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).
  • CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).
  • CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).
  • CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).
  • CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).
  • CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).
  • CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).
  • CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).
  • CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).
  • CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).
  • CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).
Record
SUSE-SU-2022:0301-1
Updated
2026-11-02
OSVUSN-4938-1 No score

unbound vulnerabilities

It was discovered that Unbound contained multiple security issues. A remote attacker could possibly use these issues to cause a denial of service, inject arbitrary commands, execute arbitrary code, and overwrite local files.

Record
USN-4938-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nsd
Alpine:v3.12
 before 4.3.4-r0
4.3.4-r0
nsd
Alpine:v3.13
 before 4.3.4-r0
4.3.4-r0
nsd
Alpine:v3.14
 before 4.3.4-r0
4.3.4-r0
nsd
Alpine:v3.15
 before 4.3.4-r0
4.3.4-r0
nsd
Alpine:v3.16
 before 4.3.4-r0
4.3.4-r0
nsd
Alpine:v3.17
 before 4.3.4-r0
4.3.4-r0
nsd
Alpine:v3.18
 before 4.3.4-r0
4.3.4-r0
nsd
Alpine:v3.19
 before 4.3.4-r0
4.3.4-r0
nsd
Alpine:v3.20
 before 4.3.4-r0
4.3.4-r0
nsd
Alpine:v3.21
 before 4.3.4-r0
4.3.4-r0
Show 66 moreShow less
Affected packages
PackageAffectedFixed
nsd
Alpine:v3.22
 before 4.3.4-r0
4.3.4-r0
nsd
Alpine:v3.23
 before 4.3.4-r0
4.3.4-r0
nsd
Alpine:v3.24
 before 4.3.4-r0
4.3.4-r0
unbound
Azure Linux:2
 before 1.10.0-5
1.10.0-5
nsd
Debian:12
 before 4.3.4-1
4.3.4-1
nsd
Debian:13
 before 4.3.4-1
4.3.4-1
nsd
Debian:14
 before 4.3.4-1
4.3.4-1
unbound
Debian:12
 before 1.13.0-1
1.13.0-1
unbound
Debian:13
 before 1.13.0-1
1.13.0-1
unbound
Debian:14
 before 1.13.0-1
1.13.0-1
unbound1.9
Debian:9
 before 1.9.0-2+deb10u2~deb9u1
1.9.0-2+deb10u2~deb9u1
unbound
Debian:10
 before 1.9.0-2+deb10u3, plus listed versions
1.9.0-21.9.0-2+deb10u11.9.0-2+deb10u2
1.9.0-2+deb10u3
unbound
Mageia:7
 before 1.10.1-1.1.mga7
1.10.1-1.1.mga7
unbound
openEuler:20.03-LTS
 before 1.11.0-2.oe1
1.11.0-2.oe1
unbound
openEuler:20.03-LTS-SP1
 before 1.11.0-2.oe1
1.11.0-2.oe1
python3-unbound
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.3-15.el8
0:1.7.3-15.el8
python3-unbound-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.3-15.el8
0:1.7.3-15.el8
unbound
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.3-15.el8
0:1.7.3-15.el8
unbound-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.3-15.el8
0:1.7.3-15.el8
unbound-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.3-15.el8
0:1.7.3-15.el8
unbound-devel
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.3-15.el8
0:1.7.3-15.el8
unbound-libs
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.3-15.el8
0:1.7.3-15.el8
unbound-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.7.3-15.el8
0:1.7.3-15.el8
python3-unbound
Red Hat:rhel_eus:8.2::appstream
 before 0:1.7.3-12.el8_2
0:1.7.3-12.el8_2
python3-unbound-debuginfo
Red Hat:rhel_eus:8.2::appstream
 before 0:1.7.3-12.el8_2
0:1.7.3-12.el8_2
unbound
Red Hat:rhel_eus:8.2::appstream
 before 0:1.7.3-12.el8_2
0:1.7.3-12.el8_2
unbound-debuginfo
Red Hat:rhel_eus:8.2::appstream
 before 0:1.7.3-12.el8_2
0:1.7.3-12.el8_2
unbound-debugsource
Red Hat:rhel_eus:8.2::appstream
 before 0:1.7.3-12.el8_2
0:1.7.3-12.el8_2
unbound-devel
Red Hat:rhel_eus:8.2::appstream
 before 0:1.7.3-12.el8_2
0:1.7.3-12.el8_2
unbound-libs
Red Hat:rhel_eus:8.2::appstream
 before 0:1.7.3-12.el8_2
0:1.7.3-12.el8_2
unbound-libs-debuginfo
Red Hat:rhel_eus:8.2::appstream
 before 0:1.7.3-12.el8_2
0:1.7.3-12.el8_2
unbound
Rocky Linux:8
 before 0:1.7.3-15.el8
0:1.7.3-15.el8
unbound
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise Server 15 SP2-BCL
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Manager Proxy 4.1
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Manager Retail Branch Server 4.1
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Manager Server 4.1
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Enterprise Storage 6
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Enterprise Storage 7
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise Real Time 15 SP2
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 1.6.8-3.9.1
1.6.8-3.9.1
unbound
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 1.6.8-3.9.1
1.6.8-3.9.1
unbound
SUSE:Linux Enterprise Server 15-LTSS
 before 1.6.8-3.9.1
1.6.8-3.9.1
unbound
SUSE:Linux Enterprise Server for SAP Applications 15
 before 1.6.8-3.9.1
1.6.8-3.9.1
unbound
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.4.20-11.4.21-11.4.21-1ubuntu11.4.21-1ubuntu21.4.22-1ubuntu1
Show 11 moreShow less
1.4.22-1ubuntu21.4.22-1ubuntu31.4.22-1ubuntu41.4.22-1ubuntu4.14.04.11.4.22-1ubuntu4.14.04.21.4.22-1ubuntu4.14.04.31.4.22-1ubuntu4.14.04.3+esm11.4.22-1ubuntu4.14.04.3+esm21.4.22-1ubuntu4.14.04.3+esm31.4.22-1ubuntu4.14.04.3+esm41.4.22-1ubuntu4.14.04.3+esm5
 None known
unbound
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.4.22-1ubuntu61.5.7-1ubuntu11.5.7-1ubuntu21.5.8-1ubuntu11.5.8-1ubuntu1.1
Show 5 moreShow less
1.5.8-1ubuntu1.1+esm11.5.8-1ubuntu1.1+esm21.5.8-1ubuntu1.1+esm31.5.8-1ubuntu1.1+esm41.5.8-1ubuntu1.1+esm5
 None known
unbound
Ubuntu:18.04:LTS
 before 1.6.7-1ubuntu2.4, plus listed versions
1.6.5-11.6.7-11.6.7-1build11.6.7-1ubuntu11.6.7-1ubuntu21.6.7-1ubuntu2.11.6.7-1ubuntu2.21.6.7-1ubuntu2.3
1.6.7-1ubuntu2.4
unbound
Ubuntu:20.04:LTS
 before 1.9.4-2ubuntu1.2, plus listed versions
1.9.0-2ubuntu11.9.0-2ubuntu21.9.4-21.9.4-2ubuntu11.9.4-2ubuntu1.1
1.9.4-2ubuntu1.2
nsd
SUSE:Package Hub 12
 before 4.3.4-bp152.2.3.1
4.3.4-bp152.2.3.1
nsd
SUSE:Package Hub 15 SP1
 before 4.3.4-bp152.2.3.1
4.3.4-bp152.2.3.1
nsd
SUSE:Package Hub 15 SP2
 before 4.3.4-bp152.2.3.1
4.3.4-bp152.2.3.1
nsd
openSUSE:Leap 15.1
 before 4.3.4-bp152.2.3.1
4.3.4-bp152.2.3.1
nsd
openSUSE:Leap 15.2
 before 4.3.4-bp152.2.3.1
4.3.4-bp152.2.3.1
unbound
openSUSE:Leap 15.3
 before 1.6.8-10.6.1
1.6.8-10.6.1
unbound
openSUSE:Tumbleweed
 before 1.13.2-1.2
1.13.2-1.2
nsd
openSUSE:Tumbleweed
 before 4.3.7-1.2
4.3.7-1.2
sslh
openSUSE:Tumbleweed
 before 2.2.3-1.1
2.2.3-1.1

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-28935 is a medium vulnerability (CVSS 5.5) in Nlnet Labs Nsd, published December 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in nsd 4.3.4-r0.

References

Show 119 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open