Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. References: http://www.openwall.com/lists/oss-security/2020/05/19/5 https://nlnetlabs.nl/downloads/unbound/CVE-2020-12662_2020-12663.txt
Created unbound tracking bugs for this issue: Affects: fedora-all [bug 1837609]
Upstream fix: https://github.com/NLnetLabs/unbound/commit/ba0f382eee814e56900a535778d13206b86b6d49
In reply to comment #2: > Upstream fix: > https://github.com/NLnetLabs/unbound/commit/ > ba0f382eee814e56900a535778d13206b86b6d49 According to https://github.com/NLnetLabs/unbound/issues/243#issuecomment-637298509, the changes related to this particular CVE are only those in iterator/iter_scrub.c and util/data/dname.c. The other changes are for CVE-2020-12662.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:2414 https://access.redhat.com/errata/RHSA-2020:2414
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:2416 https://access.redhat.com/errata/RHSA-2020:2416
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions Via RHSA-2020:2418 https://access.redhat.com/errata/RHSA-2020:2418
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2020:2419 https://access.redhat.com/errata/RHSA-2020:2419
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-12663
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2020:2640 https://access.redhat.com/errata/RHSA-2020:2640
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.7 Extended Update Support Via RHSA-2020:4181 https://access.redhat.com/errata/RHSA-2020:4181