{"id":"CVE-2020-28935","aliases":["ALPINE-CVE-2020-28935","AZL-6931","DEBIAN-CVE-2020-28935","DLA-2556-1","DLA-3371-1","EUVD-2020-21323","GHSA-q92f-7cwj-w4w5","MGASA-2021-0154","OESA-2021-1054","OESA-2021-1083","RHSA-2021:1853","RHSA-2022:0632","RLSA-2021:1853","SUSE-SU-2022:0176-1","SUSE-SU-2022:0176-2","SUSE-SU-2022:0301-1","UBUNTU-CVE-2020-28935","USN-4938-1","openSUSE-SU-2020:2222-1","openSUSE-SU-2022:0176-1","openSUSE-SU-2024:11005-1","openSUSE-SU-2024:11100-1","openSUSE-SU-2025:15069-1"],"status":"published","title":"Local symlink attack in Unbound and NSD","description":"NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00494,"percentile":0.42905,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2020-12-07T21:46:47Z","modified":"2026-10-26T12:01:58Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"nsd","fixed_in":["4.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"nsd","fixed_in":["4.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nsd","fixed_in":["4.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nsd","fixed_in":["4.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nsd","fixed_in":["4.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nsd","fixed_in":["4.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nsd","fixed_in":["4.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nsd","fixed_in":["4.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nsd","fixed_in":["4.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nsd","fixed_in":["4.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nsd","fixed_in":["4.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nsd","fixed_in":["4.3.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nsd","fixed_in":["4.3.4-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"unbound","fixed_in":["1.10.0-5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nsd","fixed_in":["4.3.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nsd","fixed_in":["4.3.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nsd","fixed_in":["4.3.4-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"unbound","fixed_in":["1.13.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"unbound","fixed_in":["1.13.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"unbound","fixed_in":["1.13.0-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"unbound","fixed_in":["1.10.1-1.1.mga7"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"unbound","fixed_in":["1.11.0-2.oe1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"unbound","fixed_in":["1.6.7-1ubuntu2.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"unbound","fixed_in":["1.9.4-2ubuntu1.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"sslh","fixed_in":["2.2.3-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"unbound1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-2+deb10u2~deb9u1"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:10","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-2+deb10u3"}]}],"versions":["1.9.0-2","1.9.0-2+deb10u1","1.9.0-2+deb10u2"],"bundled":4},{"source":"osv","ecosystem":"Mageia:7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-1.1.mga7"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-2.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-2.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-15.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-15.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-15.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-15.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-15.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-15.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-15.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-15.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"python3-unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-12.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"python3-unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-12.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-12.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-12.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"unbound-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-12.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-12.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-12.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"unbound-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-12.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Rocky Linux:8","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-15.el8"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-3.9.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-3.9.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-3.9.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-3.9.1"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.20-1","1.4.21-1","1.4.21-1ubuntu1","1.4.21-1ubuntu2","1.4.22-1ubuntu1","1.4.22-1ubuntu2","1.4.22-1ubuntu3","1.4.22-1ubuntu4","1.4.22-1ubuntu4.14.04.1","1.4.22-1ubuntu4.14.04.2","1.4.22-1ubuntu4.14.04.3","1.4.22-1ubuntu4.14.04.3+esm1","1.4.22-1ubuntu4.14.04.3+esm2","1.4.22-1ubuntu4.14.04.3+esm3","1.4.22-1ubuntu4.14.04.3+esm4","1.4.22-1ubuntu4.14.04.3+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.22-1ubuntu6","1.5.7-1ubuntu1","1.5.7-1ubuntu2","1.5.8-1ubuntu1","1.5.8-1ubuntu1.1","1.5.8-1ubuntu1.1+esm1","1.5.8-1ubuntu1.1+esm2","1.5.8-1ubuntu1.1+esm3","1.5.8-1ubuntu1.1+esm4","1.5.8-1ubuntu1.1+esm5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1ubuntu2.4"}]}],"versions":["1.6.5-1","1.6.7-1","1.6.7-1build1","1.6.7-1ubuntu1","1.6.7-1ubuntu2","1.6.7-1ubuntu2.1","1.6.7-1ubuntu2.2","1.6.7-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-2ubuntu1.2"}]}],"versions":["1.9.0-2ubuntu1","1.9.0-2ubuntu2","1.9.4-2","1.9.4-2ubuntu1","1.9.4-2ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1ubuntu2.4"}]}],"versions":["1.6.5-1","1.6.7-1","1.6.7-1build1","1.6.7-1ubuntu1","1.6.7-1ubuntu2","1.6.7-1ubuntu2.1","1.6.7-1ubuntu2.2","1.6.7-1ubuntu2.3"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-2ubuntu1.2"}]}],"versions":["1.9.0-2ubuntu1","1.9.0-2ubuntu2","1.9.4-2","1.9.4-2ubuntu1","1.9.4-2ubuntu1.1"],"bundled":13},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-bp152.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-bp152.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-bp152.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-bp152.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-bp152.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-10.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-1.2"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.7-1.2"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"sslh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"nlnet labs","product":"nsd"},{"vendor":"nlnet labs","product":"unbound"},{"vendor":"nlnetlabs","product":"name_server_daemon"},{"vendor":"nlnetlabs","product":"unbound"}],"references":[{"url":"https://www.nlnetlabs.nl/downloads/unbound/CVE-2020-28935.txt","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.nlnetlabs.nl/downloads/nsd/CVE-2020-28935.txt","tags":["x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://security.gentoo.org/glsa/202101-38","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/02/msg00017.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/03/msg00024.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28935","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-q92f-7cwj-w4w5"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-28935","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-28935","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0154.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28447","tags":["report"]},{"url":"https://www.debian.org/lts/security/2021/dla-2556","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1054","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18934","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1083","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1853","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1714175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1842837","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850460","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1878761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954772","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954778","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954782","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954794","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954796","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954797","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954799","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954801","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954804","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1853.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25032","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25032","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25032","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25034","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25034","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25034","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25035","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25035","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25035","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25036","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25036","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25036","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25037","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25037","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25037","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25038","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25038","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25038","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25039","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25039","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25039","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25040","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25041","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25041","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25041","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25042","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25042","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25042","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28935","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28935","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0632","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0632.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:1853","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220176-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1076963","tags":["report"]},{"url":"https://bugzilla.suse.com/1112009","tags":["report"]},{"url":"https://bugzilla.suse.com/1112033","tags":["report"]},{"url":"https://bugzilla.suse.com/1179191","tags":["report"]},{"url":"https://bugzilla.suse.com/1185382","tags":["report"]},{"url":"https://bugzilla.suse.com/1185383","tags":["report"]},{"url":"https://bugzilla.suse.com/1185384","tags":["report"]},{"url":"https://bugzilla.suse.com/1185385","tags":["report"]},{"url":"https://bugzilla.suse.com/1185386","tags":["report"]},{"url":"https://bugzilla.suse.com/1185387","tags":["report"]},{"url":"https://bugzilla.suse.com/1185388","tags":["report"]},{"url":"https://bugzilla.suse.com/1185389","tags":["report"]},{"url":"https://bugzilla.suse.com/1185390","tags":["report"]},{"url":"https://bugzilla.suse.com/1185391","tags":["report"]},{"url":"https://bugzilla.suse.com/1185392","tags":["report"]},{"url":"https://bugzilla.suse.com/1185393","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28935","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220176-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220301-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-28935","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4938-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-25031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25036","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-25042","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5FIDKYB6WSN55OA36HXF3BL4UYWBXAEV/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1157331","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13207","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JTS3PI42CZC7TVKVUTBOIMO2PDFTABYC/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6173","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-28935","title":"Local symlink attack in Unbound and NSD","description":"NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.","status":"published","published":"2020-12-07T21:46:47.878Z","modified":"2024-09-16T23:27:01.127Z","cwes":["CWE-59"],"updated_at":"2026-11-02T14:35:57.017407Z"}],"euvd":[{"id":"EUVD-2020-21323","description":"NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.","status":"published","published":"2020-12-07T21:46:47Z","modified":"2024-09-16T23:27:01Z","updated_at":"2026-11-03T00:54:50.364031Z"}],"ghsa":[{"id":"GHSA-q92f-7cwj-w4w5","title":"NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including...","description":"NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.","status":"published","published":"2022-05-24T17:35:44Z","modified":"2023-03-29T15:30:17Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:54:24.674255Z"}],"nvd":[{"id":"CVE-2020-28935","description":"NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.","status":"published","published":"2020-12-07T22:15:20.853Z","modified":"2026-06-17T03:10:51.017Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:06:27.10541Z"}],"osv":[{"id":"ALPINE-CVE-2020-28935","description":"NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.","status":"published","published":"2020-12-07T22:15:20.853Z","modified":"2026-10-26T11:17:55.166285769Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"AZL-6931","title":"CVE-2020-28935 affecting package unbound for versions less than 1.10.0-5","description":"NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.","status":"published","published":"2020-12-07T22:15:20Z","modified":"2026-04-21T04:38:34.193393Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:08.907584Z"},{"id":"CVE-2020-28935","description":"NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.","status":"published","published":"2020-12-07T22:15:20.853Z","modified":"2026-10-24T14:50:59.223120332Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"DEBIAN-CVE-2020-28935","description":"NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.","status":"published","published":"2020-12-07T22:15:20.853Z","modified":"2026-10-26T12:01:58.951375652Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"OESA-2021-1054","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\r\n\r\nNLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.(CVE-2020-28935)\n\nUnbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiving a specially crafted answer. This issue can only be triggered if unbound was compiled with `--enable-ipsecmod` support, and ipsecmod is enabled and used in the configuration.(CVE-2019-18934)","status":"published","published":"2021-03-05T11:04:17Z","modified":"2026-08-18T01:15:16.848938534Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"OESA-2021-1083","title":"unbound security update","description":"Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.\r\n\r\nSecurity Fix(es):\r\n\r\nNLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.(CVE-2020-28935)","status":"published","published":"2021-03-05T11:04:19Z","modified":"2026-08-18T01:15:18.860743673Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:1853","title":"Red Hat Security Advisory: unbound security, bug fix, and enhancement update","status":"published","published":"2024-09-16T05:07:35Z","modified":"2026-06-27T10:13:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2022:0632","title":"Red Hat Security Advisory: unbound security update","status":"published","published":"2024-09-16T05:07:43Z","modified":"2026-06-27T10:14:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RLSA-2021:1853","title":"Moderate: unbound security, bug fix, and enhancement update","description":"The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. \n\nSecurity Fix(es):\n\n* unbound: integer overflow in the regional allocator via regional_alloc (CVE-2019-25032)\n\n* unbound: integer overflow in sldns_str2wire_dname_buf_origin can lead to an out-of-bounds write (CVE-2019-25034)\n\n* unbound: out-of-bounds write in sldns_bget_token_par (CVE-2019-25035)\n\n* unbound: assertion failure and denial of service in synth_cname (CVE-2019-25036)\n\n* unbound: assertion failure and denial of service in dname_pkt_copy via an invalid packet (CVE-2019-25037)\n\n* unbound: integer overflow in a size calculation in dnscrypt/dnscrypt.c (CVE-2019-25038)\n\n* unbound: integer overflow in a size calculation in respip/respip.c (CVE-2019-25039)\n\n* unbound: infinite loop via a compressed name in dname_pkt_copy (CVE-2019-25040)\n\n* unbound: assertion failure via a compressed name in dname_pkt_copy (CVE-2019-25041)\n\n* unbound: out-of-bounds write via a compressed name in rdata_copy (CVE-2019-25042)\n\n* unbound: symbolic link traversal when writing PID file (CVE-2020-28935)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.","status":"published","published":"2021-05-18T06:15:09Z","modified":"2026-02-05T08:15:12.220679Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-28935","description":"NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.","status":"published","published":"2020-12-07T22:15:00Z","modified":"2026-10-21T16:30:11.646904891Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"DLA-2556-1","title":"unbound1.9 - security update","status":"published","published":"2021-02-12T00:00:00Z","modified":"2026-03-09T01:19:35.342476Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-3371-1","title":"unbound - security update","status":"published","published":"2023-03-29T00:00:00Z","modified":"2026-03-09T01:22:48.174814Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2021-0154","title":"Updated unbound packages fix a security vulnerability","description":"Unbound contains a local vulnerability that would allow for a local symlink\nattack. When writing the PID file Unbound creates the file if it is not there,\nor opens an existing file for writing. In case the file was already present, it\nwould follow symlinks if the file happened to be a symlink instead of a regular\nfile (CVE-2020-28935).\n","status":"published","published":"2021-03-27T14:27:02Z","modified":"2026-04-16T04:42:59.237468248Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:2222-1","title":"Security update for nsd","description":"This update for nsd fixes the following issues:\n\nnsd was updated to the new upstream release 4.3.4\n\nFEATURES:\n\n- Merge PR #141: ZONEMD RR type.\n\nBUG FIXES:\n\n- Fix that symlink does not interfere with chown of pidfile\n  (boo#1179191, CVE-2020-28935)\n- Fix #128: Fix that the invalid port number is logged for sendmmsg failed: Invalid argument.\n- Fix #133: fix 0-init of local ( stack ) buffer.\n- Fix #134: IPV4_MINIMAL_RESPONSE_SIZE vs EDNS_MAX_MESSAGE_LEN.\n- Fix to add missing closest encloser NSEC3 for wildcard nodata type DS answer.\n- Fix #138: NSD returns non-EDNS answer when QUESTION is empty.\n- Fix #142: NODATA answers missin SOA in authority section after CNAME chain.\n\nNew upstream release 4.3.3:\n\nFEATURES:\n\n- Follow DNS flag day 2020 advice and set default EDNS message size to 1232.\n- Merged PR #113 with fixes.  Instead of listing an IP-address to\n  listen on, an interface name can be specified in nsd.conf, with\n  ip-address: eth0.  The IP-addresses for that interface are then used.\n\n- New upstream release 4.3.2\n\nFEATURES:\n\n- Fix #96: log-only-syslog: yes sets to only use syslog, fixes\n  that the default configuration and systemd results in duplicate\n  log messages.\n- Fix #107: nsd -v shows configure line, openssl version and libevent\n  version.\n- Fix #103 with #110: min-expire-time option.  To provide a lower\n  bound for expire period.  Expressed in number of seconds or\n  refresh+retry+1.\n\nBUG FIXES:\n\n- Fix to omit the listen-on lines from log at startup, unless verbose.\n- Fix #97: EDNS unknown version: query not in response.\n- Fix #99: Fix copying of socket properties with reuseport enabled.\n- Document default value for tcp-timeout.\n- Merge PR#102 from and0x000: add missing default in documentation for drop-updates.\n- Fix unlink of pidfile warning if not possible due to permissions,\n  nsd can display the message at high verbosity levels.\n- Removed contrib/nsd.service, example is too complicated and not useful.\n- Merge #108 from Nomis: Make the max-retry-time description clearer.\n- Retry when udp send buffer is full to wait until buffer space is available.\n- Remove errno reset behaviour from sendmmsg and recvmmsg replacement functions.\n- Fix unit test for different nsd-control-setup -h exit code.\n- Merge #112 from jaredmauch: log old and new serials when NSD\n  rejects an IXFR due to an old serial number.\n- Fix #106: Adhere better to xfrd bounds.  Refresh and retry times.\n- Fix #105: Clearing hash_tree means just emptying the tree.\n\nNew upstream release 4.3.1\n\nBUG FIXES:\n- Merge PR #91 by gearnode: nsd-control-setup recreate certificates.\n  The '-r' option recreates certificates.  Without it it creates them\n  if they do not exist, and does not modify them otherwise.\n\nNew upstream release 4.3.0\n\nFEATURES:\n\n- Fix to use getrandom() for randomness, if available.\n- Fix #56: Drop sparse TSIG signing support in NSD.\n  Sign every axfr packet with TSIG, according to the latest\n  draft-ietf-dnsop-rfc2845bis-06, Section 5.3.1.\n- Merge pull request #59 from buddyns: add FreeBSD support\n  for conf key ip-transparent.\n- Add feature to pin server processes to specific cpus.\n- Add feature to pin IP addresses to selected server processes.\n- Set process title to identify individual processes.\n- Merge PR#22: minimise-any: prefer polular and not large RRset,\n  from Daisuke Higashi.\n- Add support for SO_BINDTODEVICE on Linux.\n- Add feature to drop queries with opcode UPDATE.\n\nBUG FIXES:\n\n- Fix whitespace in nsd.conf.sample.in, patch from Paul Wouters.\n- use-systemd is ignored in nsd.conf, when NSD is compiled with\n  libsystemd it always signals readiness, if possible.\n- Note that use-systemd is not necessary and ignored in man page.\n- Fix responses for IXFR so that the authority section is not echoed\n  in the response.\n- Fix that the retry wait does not exceed one day for zone transfers.\n\n- Update keyring as per https://nlnetlabs.nl/people/\n\nNew upstream release 4.2.3:\n\n  * confine-to-zone configures NSD to not return out-of-zone\n    additional information.\n  * pidfile '' allows to run NSD without a pidfile\n  * adds support for readiness notification with READY_FD\n  * fix excessive logging of ixfr failures, it stops the log when\n    fallback to axfr is possible. log is enabled at high verbosity.\n  * The nsd.conf includes are sorted ascending, for include statements\n    with a '*' from glob.\n  * Fix log address and failure reason with tls handshake errors,\n    squelches (the same as unbound) some unless high verbosity is used.\n  * Number of different UDP handlers has been reduced to one.\n    recvmmsg and sendmmsg implementations are now used on all platforms.\n  * Socket options are now set in designated functions for easy reuse.\n  * Socket setup has been simplified for easy reuse.\n  * Configuration parser is now aware of the context in which\n    an option was specified.\n  * document that remote-control is a top-level nsd.conf attribute.\n\n- Remove legacy upgrade of nsd users in %post (boo#1157331)\n\nNew upstream release 4.2.2:\n\n  * Fix #20: CVE-2019-13207 Stack-based Buffer Overflow in the\n    dname_concatenate() function.  Reported by Frederic Cambus.\n    It causes the zone parser to crash on a malformed zone file,\n    with assertions enabled, an assertion catches it.\n  * Fix #19: Out-of-bounds read caused by improper validation of\n    array index.  Reported by Frederic Cambus.  The zone parser\n    fails on type SIG because of mismatched definition with RRSIG.\n  * PR #23: Fix typo in nsd.conf man-page.\n  * Fix that NSD warns for wrong length of the hash in SSHFP records.\n  * Fix #25: NSD doesn't refresh zones after extended downtime,\n    it refreshes the old zones.\n  * Set no renegotiation on the SSL context to stop client\n    session renegotiation.\n  * Fix #29: SSHFP check NULL pointer dereference.\n  * Fix #30: SSHFP check failure due to missing domain name.\n  * Fix to timeval_add in minievent for remaining second in microseconds.\n  * PR #31: nsd-control: Add missing stdio header.\n  * PR #32: tsig: Fix compilation without HAVE_SSL.\n  * Cleanup tls context on xfrd exit.\n  * Fix #33: Fix segfault in service of remaining streams on exit.\n  * Fix error message for out of zone data to have more information.\n\nNew upstream release 4.2.1:\n\n  * FEATURES:\n\n    - Added num.tls and num.tls6 stat counters.\n    - PR #12: send-buffer-size, receive-buffer-size,\n      tcp-reject-overflow options for nsd.conf, from Jeroen Koekkoek.\n    - Fix #14, tcp connections have 1/10 to be active and have to work\n      every second, and then they get time to complete during a reload,\n      this is a process that lingers with the old version during a version\n      update.\n\n  * BUG FIXES:\n\n    - Fix #13: Stray dot at the end of some log entries, removes dot\n      after updated serial number in log entry.\n    - Fix TLS cipher selection, the previous was redundant, prefers\n      CHACHA20-POLY1305 over AESGCM and was not as readable as it\n      could be.\n    - Fix #15: crash in SSL library, initialize variables for TCP access\n      when TLS is configured.\n    - Fix tls handshake event callback function mistake, reported\n      by Mykhailo Danylenko.\n    - Fix output of nsd-checkconf -h.\n\nNew upstream release 4.2.0:\n\n  * Implement TCP fast open\n  * Added DNS over TLS\n  * TLS OCSP stapling support with the tls-service-ocsp option\n  * New option hide-identity can be used in nsd.conf to stop NSD\n    from responding with the hostname for probe queries that\n    elicit the chaos class response, this is conform RFC4892\n  * Disable TLS1.0, TLS1.1 and weak ciphers, enable CIPHER_SERVER_PREFERENCE\n\nUpdate to upstream release 4.1.27:\n\n* FEATURES:\n\n    - Deny ANY with only one RR in response, by default.  Patch from\n      Daisuke Higashi.  The deny-any statement in nsd.conf sets ANY\n      queries over UDP to be further moved to TCP as well.\n      Also no additional section processig for type ANY, reducing\n      the response size.\n    - Fix #4215: on-the-fly change of TSIG keys with patch from Igor, adds\n      nsd-control print_tsig, update_tsig, add_tsig, assoc_tsig\n      and del_tsig.  These changes are gone after reload, edit the\n      config file (or a file included from it) to make changes that\n      last after restart.\n\n* BUG FIXES:\n\nUpdate to upstream release 4.1.26:\n\n  * FEATURES:\n\n    - DNSTAP support for NSD, --enable-dnstap and then config in nsd.conf.\n    - Support SO_REUSEPORT_LB in FreeBSD 12 with the reuseport: yes\n      option in nsd.conf.\n    - Added nsd-control changezone.  nsd-control changezone name pattern\n      allows the change of a zone pattern option without downtime for\n      the zone, in one operation.\n\n  * BUG FIXES:\n\n    - Fix #4194: Zone file parser derailed by non-FQDN names in RHS of DNSSEC RRs.\n    - Fix #4202: nsd-control delzone incorrect exit code on error.\n    - Fix to not set GLOB_NOSORT so the nsd.conf include: files are\n      sorted and in a predictable order.\n    - Fix #3433: document that reconfig does not change per-zone stats.\n\nUpdate to upstream release 4.1.25:\n\n  * FEATURES:\n\n    - nsd-control prints neater errors for file failures.\n\n  * BUG FIXES:\n\n    - Fix that nsec3 precompile deletion happens before the RRs of\n      the zone are deleted.\n    - Fix printout of accepted remote control connection for unix sockets.\n    - Fix use_systemd typo/leftover in remote.c.\n    - Fix codingstyle in nsd-checkconf.c in patch from Sharp Liu.\n    - append_trailing_slash has one implementation and is not repeated\n      differently.\n    - Fix coding style in nsd.c\n    - Fix to combine the same error function into one, from Xiaobo Liu.\n    - Fix initialisation in remote.c.\n    - please clang analyzer and fix parse of IPSECKEY with bad gateway.\n    - Fix nsd-checkconf fail on bad zone name.\n    - Annotate exit functions with noreturn.\n    - Remove unused if clause during server service startup.\n    - Fix #4156: Fix systemd service manager state change notification\n      When it is compiled, systemd readiness signalling is enabled.\n      The option in nsd.conf is not used, it is ignored when read.\n\nUpdate to upstream release 4.1.24:\n\n- Features\n\n    * #4102: control interface via local socket\n    * configure --enable-systemd (needs pkg-config and libsystemd) can be \n      used to then use-systemd: yes in nsd.conf and have readiness signalling \n      with systemd.\n    * RFC8162 support, for record type SMIMEA.\n  - Bug Fixes\n    * Patch to fix openwrt for mac os build darwin detection in configure.\n    * Fix that first control-interface determines if TLS is used.\n      Warn when IP address interfaces are used without TLS.\n    * #4106: Fix that stats printed from nsd-control are recast from\n      unsigned long to unsigned (remote.c).\n    * Fix that type CAA (and URI) in the zone file can contain dots\n      when not in quotes.\n    * #4133: Fix that when IXFR contains a zone with broken NSEC3PARAM chain,\n      NSD leniently attempts to find a working NSEC3PARAM.\n\nUpdate to upstream release 4.1.23:\n\n  - Fix NSD time sensitive TSIG compare vulnerability.\n\nUpdate to upstream release 4.1.22:\n\n  - Features:\n    * refuse-any sends truncation (+TC) in reply to ANY queries\n    over UDP, and allows TCP queries like normal.\n    * Use accept4 to speed up answer of TCP queries\n  - Bug fixes:\n    * Fix nsec3 hash of parent and child co-hosted nsec3 enabled zones.\n    * Fix to use same condition for nsec3 hash allocation and free.\n\n- Changes in version 4.1.21:\n\n  - Features:\n    * --enable-memclean cleans up memory for use with memory checkers,\n      eg. valgrind.\n    * refuse-any nsd.conf option that refuses queries of type ANY.\n    * lower memory usage for tcp connections, so tcp-count can be\n      higher.\n  - Bug fixes:\n    * Fix spelling error in xfr-inspect.\n    * Fix buffer size warnings from compiler on filename lengths.\n","status":"published","published":"2020-12-10T11:23:12Z","modified":"2026-02-04T03:36:26.088683Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2022:0176-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).\n- CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).\n- CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).\n- CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).\n- CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).\n- CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).\n- CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).\n- CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).\n- CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).\n- CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).\n- CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).\n- CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).\n- CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).\n","status":"published","published":"2022-01-25T13:13:02Z","modified":"2025-05-07T18:11:02.529949Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11005-1","title":"libunbound8-1.13.2-1.2 on GA media","description":"These are all security issues fixed in the libunbound8-1.13.2-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:26:18.219061Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:11100-1","title":"nsd-4.3.7-1.2 on GA media","description":"These are all security issues fixed in the nsd-4.3.7-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:14:51.719778Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2025:15069-1","title":"sslh-2.2.3-1.1 on GA media","description":"These are all security issues fixed in the sslh-2.2.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-08T00:00:00Z","modified":"2026-02-04T02:29:34.736641Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2022:0176-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).\n- CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).\n- CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).\n- CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).\n- CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).\n- CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).\n- CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).\n- CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).\n- CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).\n- CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).\n- CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).\n- CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).\n- CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).\n","status":"published","published":"2022-01-25T13:13:57Z","modified":"2026-02-04T04:08:14.067883Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0176-2","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).\n- CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).\n- CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).\n- CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).\n- CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).\n- CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).\n- CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).\n- CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).\n- CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).\n- CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).\n- CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).\n- CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).\n- CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).\n","status":"published","published":"2022-02-15T06:39:05Z","modified":"2026-02-04T02:19:26.886123Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0301-1","title":"Security update for unbound","description":"This update for unbound fixes the following issues:\n\n- CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).\n- CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).\n- CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).\n- CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).\n- CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).\n- CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).\n- CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).\n- CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).\n- CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).\n- CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).\n- CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).\n- CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).\n- CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).\n","status":"published","published":"2022-02-02T09:05:06Z","modified":"2026-02-04T04:31:50.533888Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"USN-4938-1","title":"unbound vulnerabilities","description":"It was discovered that Unbound contained multiple security issues. A\nremote attacker could possibly use these issues to cause a denial of\nservice, inject arbitrary commands, execute arbitrary code, and overwrite\nlocal files.\n","status":"published","published":"2021-05-06T12:58:29Z","modified":"2026-04-27T16:03:37.543872505Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}