{"id":"CVE-2017-15105","aliases":["DEBIAN-CVE-2017-15105","DLA-1264-1","DLA-1676-1","EUVD-2017-6570","GHSA-8hp4-8fgw-m69h","MGASA-2018-0091","UBUNTU-CVE-2017-15105","USN-3673-1","openSUSE-SU-2024:11005-1"],"status":"published","title":"A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An...","description":"A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence (NXDOMAIN answer) of an existing wildcard record, or trick unbound into accepting a NODATA proof.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03162,"percentile":0.88074,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-358"],"published":"2018-01-22T21:02:28Z","modified":"2026-10-24T10:30:36Z","fixes":[{"ecosystem":"Debian:12","package":"unbound","fixed_in":["1.7.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"unbound","fixed_in":["1.7.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"unbound","fixed_in":["1.7.1-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"unbound","fixed_in":["1.4.17-3+deb7u3"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"unbound","fixed_in":["1.4.22-3+deb8u4"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"unbound","fixed_in":["1.6.8-1.mga6"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"unbound","fixed_in":["1.4.22-1ubuntu4.14.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"unbound","fixed_in":["1.5.8-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"unbound","fixed_in":["1.6.7-1ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.17-3+deb7u3"}]}],"versions":["1.4.17-3","1.4.17-3+deb7u1","1.4.17-3+deb7u2"]},{"source":"osv","ecosystem":"Debian:8","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-3+deb8u4"}]}],"versions":["1.4.22-3","1.4.22-3+deb8u1","1.4.22-3+deb8u2","1.4.22-3+deb8u3"]},{"source":"osv","ecosystem":"Mageia:6","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-1.mga6"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-1ubuntu4.14.04.3"}]}],"versions":["1.4.20-1","1.4.21-1","1.4.21-1ubuntu1","1.4.21-1ubuntu2","1.4.22-1ubuntu1","1.4.22-1ubuntu2","1.4.22-1ubuntu3","1.4.22-1ubuntu4","1.4.22-1ubuntu4.14.04.1","1.4.22-1ubuntu4.14.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.8-1ubuntu1.1"}]}],"versions":["1.4.22-1ubuntu6","1.5.7-1ubuntu1","1.5.7-1ubuntu2","1.5.8-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1ubuntu2.1"}]}],"versions":["1.6.5-1","1.6.7-1","1.6.7-1build1","1.6.7-1ubuntu1","1.6.7-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-1ubuntu4.14.04.3"}]}],"versions":["1.4.20-1","1.4.21-1","1.4.21-1ubuntu1","1.4.21-1ubuntu2","1.4.22-1ubuntu1","1.4.22-1ubuntu2","1.4.22-1ubuntu3","1.4.22-1ubuntu4","1.4.22-1ubuntu4.14.04.1","1.4.22-1ubuntu4.14.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.8-1ubuntu1.1"}]}],"versions":["1.4.22-1ubuntu6","1.5.7-1ubuntu1","1.5.7-1ubuntu2","1.5.8-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1ubuntu2.1"}]}],"versions":["1.6.5-1","1.6.7-1","1.6.7-1build1","1.6.7-1ubuntu1","1.6.7-1ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-1.2"}]}],"bundled":6}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"nlnet labs","product":"unbound"},{"vendor":"nlnetlabs","product":"unbound"}],"references":[{"url":"http://www.securityfocus.com/bid/102817","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/02/msg00022.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/01/msg00039.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://unbound.net/downloads/CVE-2017-15105.txt","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://usn.ubuntu.com/3673-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15105"},{"url":"https://github.com/advisories/GHSA-8hp4-8fgw-m69h"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-15105","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0091.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22423","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15105","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3673-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15105","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28935","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-15105","description":"A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence (NXDOMAIN answer) of an existing wildcard record, or trick unbound into accepting a NODATA proof.","status":"published","published":"2018-01-23T16:00:00Z","modified":"2024-09-16T21:56:27.39Z","cwes":["CWE-358"],"updated_at":"2026-11-02T14:33:14.271248Z"}],"euvd":[{"id":"EUVD-2017-6570","description":"A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence (NXDOMAIN answer) of an existing wildcard record, or trick unbound into accepting a NODATA proof.","status":"published","published":"2018-01-23T16:00:00Z","modified":"2024-09-16T21:56:27Z","updated_at":"2026-11-03T00:55:07.646084Z"}],"ghsa":[{"id":"GHSA-8hp4-8fgw-m69h","title":"A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An...","description":"A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence (NXDOMAIN answer) of an existing wildcard record, or trick unbound into accepting a NODATA proof.","status":"published","published":"2022-05-13T01:37:34Z","modified":"2023-02-01T05:09:07Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:50:55.065879Z"}],"nvd":[{"id":"CVE-2017-15105","description":"A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence (NXDOMAIN answer) of an existing wildcard record, or trick unbound into accepting a NODATA proof.","status":"published","published":"2018-01-23T16:29:00.273Z","modified":"2026-06-17T01:07:15.68Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-358","CWE-20"],"updated_at":"2026-11-02T14:04:13.257031Z"}],"osv":[{"id":"CVE-2017-15105","description":"A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence (NXDOMAIN answer) of an existing wildcard record, or trick unbound into accepting a NODATA proof.","status":"published","published":"2018-01-23T16:29:00.273Z","modified":"2026-10-24T10:30:36.059925297Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:04.572713Z"},{"id":"DEBIAN-CVE-2017-15105","description":"A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence (NXDOMAIN answer) of an existing wildcard record, or trick unbound into accepting a NODATA proof.","status":"published","published":"2018-01-23T16:29:00.273Z","modified":"2026-09-01T20:03:44.355299128Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"UBUNTU-CVE-2017-15105","description":"A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence (NXDOMAIN answer) of an existing wildcard record, or trick unbound into accepting a NODATA proof.","status":"published","published":"2018-01-23T00:00:00Z","modified":"2026-04-22T11:17:00.316863Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"DLA-1264-1","title":"unbound - security update","status":"published","published":"2018-01-30T00:00:00Z","modified":"2026-03-09T01:01:40.468503Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DLA-1676-1","title":"unbound - security update","status":"published","published":"2019-02-14T00:00:00Z","modified":"2026-03-09T01:18:13.743042Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"MGASA-2018-0091","title":"Updated unbound packages fix security vulnerability","description":"Updated unbound packages to fix security vulnerability (CVE-2017-15105)\nin the processing of wildcard synthesized NSEC records. While synthesis\nof NSEC records is allowed by RFC4592, these synthesized owner names\nshould not be used in the NSEC processing. This was, however, happenning\nin Unbound 1.6.7 and earlier versions.\n","status":"published","published":"2018-01-22T21:02:28Z","modified":"2026-04-16T06:25:31.97641676Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:11005-1","title":"libunbound8-1.13.2-1.2 on GA media","description":"These are all security issues fixed in the libunbound8-1.13.2-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:26:18.219061Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-3673-1","title":"unbound vulnerability","description":"Ralph Dolmans and Karst Koymans discovered that Unbound did not properly\nhandle certain NSEC records. An attacker could use this to to prove the\nnon-existence (NXDOMAIN answer) of an existing wildcard record, or trick\nUnbound into accepting a NODATA proof.\n","status":"published","published":"2018-06-07T22:21:42Z","modified":"2026-04-22T09:46:40.893972Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}