Bug 1954809 (CVE-2019-25031)
| Summary: | CVE-2019-25031 unbound: configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED WONTFIX | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aegorenk, akhaitovich, paul.wouters, pemensik, pj.pandit |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | unbound 1.9.6 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in unbound. The create_unbound_ad_servers.sh bash script does not properly sanitize input data, which is retrieved using an unencrypted, unauthenticated HTTP request, before writing the configuration file allowing a man-in-the-middle attack. The highest threat from this vulnerability is to data integrity and system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-05-06 14:33:51 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1954811 | ||
|
Description
Guilherme de Almeida Suckevicz
2021-04-28 19:20:40 UTC
what is the point of creating these old issues? External References: https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ In reply to comment #1: > what is the point of creating these old issues? As said elsewhere, these are about the flaws in general, so not really specific to Fedora. That said... I agree these were probably not necessary because all these issues were part of an audit report that is very old and together with the author of the audit (x41) and NLNet Labs (CNA for Unbound) we chose to not consider these CVE-worthy. Reason for that was that most of these old issues could not really be triggered during regular usage and were more of an hardening than real vulnerabilities. Apparently someone assigned CVEs to these issues anyway, one year later. NLNet Labs has been notified of these CVEs and we'll see what they want to do with these. Upstream patch: https://github.com/NLnetLabs/unbound/commit/f887552763477a606a9608b0f6b498685e0f6587 Statement: This issue did not affect the versions of unbound as shipped with Red Hat Enterprise Linux 7, and 8 as they did not include the vulnerable script create_unbound_ad_servers.sh. This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-25031 |