Bug 2316321 (CVE-2024-8508)
| Summary: | CVE-2024-8508 unbound: Unbounded name compression could lead to Denial of Service | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | asoldano, bbaranow, bdettelb, bmaxwell, brian.stansberry, cdewolf, chazlett, darran.lofthouse, dhanak, dkreling, doconnor, dosoudil, ecerquei, eglynn, fjuma, fmariani, fmongiar, gmalinko, ibek, istudens, ivassile, iweiss, janstey, jcantril, jjoyce, jnethert, jpoth, jrokos, jschluet, kverlaen, lgao, lhh, lsurette, lsvaty, mburns, mgarciac, michal.skrivanek, mnovotny, mosmerov, mperina, msochure, msvehla, nwallace, pemensik, pgrist, pjindal, pmackay, rguimara, rstancel, rstepani, sbonazzo, smaestri, tcunning, teagle, tom.jenkinson, yfang |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was found in Unbound which can lead to degraded performance and an eventual denial of service when handling replies with very large RRsets that require name compression to be applied. Versions prior to 1.21.1 do not have a hard limit on the number of name compression calculations that Unbound can perform per packet, meaning that if a specially crafted query is passed for the contents of a malicious zone with very large RRsets, Unbound may spend a considerable amount of time applying name compression to downstream replies, locking the CPU until the whole packet has been processed.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2316358, 2316359 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2024-10-03 17:01:16 UTC
Upstream information about the CVE: https://nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:11232 https://access.redhat.com/errata/RHSA-2024:11232 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2024:11170 https://access.redhat.com/errata/RHSA-2024:11170 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2025:0140 https://access.redhat.com/errata/RHSA-2025:0140 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2025:0837 https://access.redhat.com/errata/RHSA-2025:0837 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2025:1120 https://access.redhat.com/errata/RHSA-2025:1120 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2025:8047 https://access.redhat.com/errata/RHSA-2025:8047 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:8197 https://access.redhat.com/errata/RHSA-2025:8197 |