{"id":"CVE-2019-25031","aliases":["DEBIAN-CVE-2019-25031","DLA-2652-1","EUVD-2019-11481","GHSA-9vvw-9wr3-56v3","SUSE-SU-2022:0176-1","SUSE-SU-2022:0176-2","SUSE-SU-2022:0301-1","UBUNTU-CVE-2019-25031","USN-4938-1","openSUSE-SU-2022:0176-1"],"status":"disputed","title":"Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a...","description":"Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. create_unbound_ad_servers.sh is a contributed script from the community that facilitates automatic configuration creation. It is not part of the Unbound installation","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01675,"percentile":0.77022,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2021-04-27T05:18:17Z","modified":"2026-10-24T14:03:41Z","fixes":[{"ecosystem":"Debian:12","package":"unbound","fixed_in":["1.9.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"unbound","fixed_in":["1.9.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"unbound","fixed_in":["1.9.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"unbound","fixed_in":["1.6.7-1ubuntu2.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"unbound","fixed_in":["1.9.4-2ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"unbound1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-2+deb10u2~deb9u2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-3.9.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-3.9.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-3.9.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-3.9.1"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1ubuntu2.4"}]}],"versions":["1.6.5-1","1.6.7-1","1.6.7-1build1","1.6.7-1ubuntu1","1.6.7-1ubuntu2","1.6.7-1ubuntu2.1","1.6.7-1ubuntu2.2","1.6.7-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-2ubuntu1.2"}]}],"versions":["1.9.0-2ubuntu1","1.9.0-2ubuntu2","1.9.4-2","1.9.4-2ubuntu1","1.9.4-2ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1ubuntu2.4"}]}],"versions":["1.6.5-1","1.6.7-1","1.6.7-1build1","1.6.7-1ubuntu1","1.6.7-1ubuntu2","1.6.7-1ubuntu2.1","1.6.7-1ubuntu2.2","1.6.7-1ubuntu2.3"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-2ubuntu1.2"}]}],"versions":["1.9.0-2ubuntu1","1.9.0-2ubuntu2","1.9.4-2","1.9.4-2ubuntu1","1.9.4-2ubuntu1.1"],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"nlnetlabs","product":"unbound"}],"references":[{"url":"https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/","tags":["x_refsource_MISC","x_transferred","Not Applicable","Third Party Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210507-0007/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25031"},{"url":"https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results"},{"url":"https://security.netapp.com/advisory/ntap-20210507-0007"},{"url":"https://github.com/advisories/GHSA-9vvw-9wr3-56v3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-25031","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220176-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1076963","tags":["report"]},{"url":"https://bugzilla.suse.com/1112009","tags":["report"]},{"url":"https://bugzilla.suse.com/1112033","tags":["report"]},{"url":"https://bugzilla.suse.com/1179191","tags":["report"]},{"url":"https://bugzilla.suse.com/1185382","tags":["report"]},{"url":"https://bugzilla.suse.com/1185383","tags":["report"]},{"url":"https://bugzilla.suse.com/1185384","tags":["report"]},{"url":"https://bugzilla.suse.com/1185385","tags":["report"]},{"url":"https://bugzilla.suse.com/1185386","tags":["report"]},{"url":"https://bugzilla.suse.com/1185387","tags":["report"]},{"url":"https://bugzilla.suse.com/1185388","tags":["report"]},{"url":"https://bugzilla.suse.com/1185389","tags":["report"]},{"url":"https://bugzilla.suse.com/1185390","tags":["report"]},{"url":"https://bugzilla.suse.com/1185391","tags":["report"]},{"url":"https://bugzilla.suse.com/1185392","tags":["report"]},{"url":"https://bugzilla.suse.com/1185393","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28935","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220176-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220301-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-25031","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4938-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25036","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25042","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-28935","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JTS3PI42CZC7TVKVUTBOIMO2PDFTABYC/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-25031","description":"Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. create_unbound_ad_servers.sh is a contributed script from the community that facilitates automatic configuration creation. It is not part of the Unbound installation","status":"disputed","published":"2021-04-27T05:18:17Z","modified":"2024-08-05T03:00:18.956Z","updated_at":"2026-11-02T14:20:19.737165Z"}],"euvd":[{"id":"EUVD-2019-11481","description":"Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. create_unbound_ad_servers.sh is a contributed script from the community that facilitates automatic configuration creation. It is not part of the Unbound installation","status":"published","published":"2021-04-27T05:18:17Z","modified":"2024-08-05T03:00:18Z","updated_at":"2026-11-03T02:40:20.270172Z"}],"ghsa":[{"id":"GHSA-9vvw-9wr3-56v3","title":"Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a...","description":"Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session.","status":"published","published":"2022-05-24T17:48:59Z","modified":"2024-03-21T03:34:04Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:55:42.026509Z"}],"nvd":[{"id":"CVE-2019-25031","description":"Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. create_unbound_ad_servers.sh is a contributed script from the community that facilitates automatic configuration creation. It is not part of the Unbound installation","status":"disputed","published":"2021-04-27T06:15:07.447Z","modified":"2026-08-25T10:55:42.71Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:05:48.502374Z"}],"osv":[{"id":"CVE-2019-25031","description":"Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. create_unbound_ad_servers.sh is a contributed script from the community that facilitates automatic configuration creation. It is not part of the Unbound installation","status":"published","published":"2021-04-27T06:15:07.447Z","modified":"2026-10-24T14:03:41.809326629Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-25031","description":"Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. create_unbound_ad_servers.sh is a contributed script from the community that facilitates automatic configuration creation. It is not part of the Unbound installation","status":"published","published":"2021-04-27T06:15:07.447Z","modified":"2026-09-21T07:03:18.169762134Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"UBUNTU-CVE-2019-25031","description":"Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. create_unbound_ad_servers.sh is a contributed script from the community that facilitates automatic configuration creation. It is not part of the Unbound installation","status":"published","published":"2021-04-27T06:15:00Z","modified":"2026-04-22T12:17:48.495903Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"DLA-2652-1","title":"unbound1.9 - security update","status":"published","published":"2021-05-06T00:00:00Z","modified":"2026-03-09T01:21:22.194101Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"openSUSE-SU-2022:0176-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).\n- CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).\n- CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).\n- CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).\n- CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).\n- CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).\n- CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).\n- CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).\n- CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).\n- CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).\n- CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).\n- CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).\n- CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).\n","status":"published","published":"2022-01-25T13:13:02Z","modified":"2025-05-07T18:11:02.529949Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"SUSE-SU-2022:0176-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).\n- CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).\n- CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).\n- CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).\n- CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).\n- CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).\n- CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).\n- CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).\n- CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).\n- CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).\n- CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).\n- CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).\n- CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).\n","status":"published","published":"2022-01-25T13:13:57Z","modified":"2026-02-04T04:08:14.067883Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0176-2","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).\n- CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).\n- CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).\n- CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).\n- CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).\n- CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).\n- CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).\n- CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).\n- CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).\n- CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).\n- CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).\n- CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).\n- CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).\n","status":"published","published":"2022-02-15T06:39:05Z","modified":"2026-02-04T02:19:26.886123Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0301-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).\n- CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).\n- CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).\n- CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).\n- CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).\n- CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).\n- CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).\n- CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).\n- CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).\n- CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).\n- CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).\n- CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).\n- CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).\n","status":"published","published":"2022-02-02T09:05:06Z","modified":"2026-02-04T04:31:50.533888Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"USN-4938-1","title":"unbound vulnerabilities","description":"It was discovered that Unbound contained multiple security issues. A\nremote attacker could possibly use these issues to cause a denial of\nservice, inject arbitrary commands, execute arbitrary code, and overwrite\nlocal files.\n","status":"published","published":"2021-05-06T12:58:29Z","modified":"2026-04-27T16:03:37.543872505Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}