NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain code path that can lead to an infinite loop. Unbound 1.18.0 introduced a feature that removes EDE records from responses with size higher than the client's advertised buffer size. Before removing all the EDE records however, it would try to see if trimming the extra text fields on those records would result in an acceptable size while still retaining the EDE codes. Due to an unchecked condition, the code that trims the text of the EDE records could loop indefinitely. This happens when Unbound would reply with attached EDE information on a positive reply and the client's buffer size is smaller than the needed space to include EDE records. The vulnerability can only be triggered when the 'ede: yes' option is used; non default configuration. From version 1.19.2 on, the code is fixed to avoid looping indefinitely.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-5f32029828 advisory.

    Automatic update for unbound-1.19.3-1.fc41.

    ##### **Changelog**

    ```
    * Fri Apr 12 2024 Petr Menk <pemensik@redhat.com> - 1.19.3-1
    - Update to 1.19.3 (rhbz#2268404)
    - Fix CVE-2024-1931, Denial of service when trimming EDE text on positive       replies. (rhbz#2268419)
    - Use the origin (DNAME) TTL for synthesized CNAMEs as per RFC 6672.
    - Bug fixes
    * Sat Mar  9 2024 Paul Wouters <paul.wouters@aiven.io> - 1.19.1-4
    - Add spec file comment

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-8b20de41f0 advisory.

    - Use the origin (DNAME) TTL for synthesized CNAMEs as per RFC 6672.
    - Bug fixes

    https://nlnetlabs.nl/projects/unbound/download/#unbound-1-19-3


    ----

    CVE-2024-1931 - Fix trim of EDE text from large udp responses from spinning cpu.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-3b173364d4 advisory.

    - Use the origin (DNAME) TTL for synthesized CNAMEs as per RFC 6672.
    - Bug fixes

    https://nlnetlabs.nl/projects/unbound/download/#unbound-1-19-3

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-5bfa220621 advisory.

    - Use the origin (DNAME) TTL for synthesized CNAMEs as per RFC 6672.
    - Bug fixes

    https://nlnetlabs.nl/projects/unbound/download/#unbound-1-19-3

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c2ad8700-de25-11ee-9190-84a93843eb75 advisory.

  - NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can     cause denial of service by a certain code path that can lead to an infinite loop. Unbound 1.18.0     introduced a feature that removes EDE records from responses with size higher than the client's advertised     buffer size. Before removing all the EDE records however, it would try to see if trimming the extra text     fields on those records would result in an acceptable size while still retaining the EDE codes. Due to an     unchecked condition, the code that trims the text of the EDE records could loop indefinitely. This happens     when Unbound would reply with attached EDE information on a positive reply and the client's buffer size is     smaller than the needed space to include EDE records. The vulnerability can only be triggered when the     'ede: yes' option is used; non default configuration. From version 1.19.2 on, the code is fixed to avoid     looping indefinitely. (CVE-2024-1931)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211409	Fedora 41 : unbound (2024-5f32029828)	Nessus	Fedora Local Security Checks	high
194542	Fedora 40 : unbound (2024-8b20de41f0)	Nessus	Fedora Local Security Checks	high
194345	Fedora 39 : unbound (2024-3b173364d4)	Nessus	Fedora Local Security Checks	high
194343	Fedora 38 : unbound (2024-5bfa220621)	Nessus	Fedora Local Security Checks	high
191777	FreeBSD : Unbound -- Denial-of-Service vulnerability (c2ad8700-de25-11ee-9190-84a93843eb75)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2024-1931

high

Tenable Plugins

high

high

high

high

high