CVE-2019-25031
27.04.2021, 06:15
Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. create_unbound_ad_servers.sh is a contributed script from the community that facilitates automatic configuration creation. It is not part of the Unbound installation
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| nlnetlabs | unbound | 𝑥 < 1.9.5 |
| debian | debian_linux | 9.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libunbound2 |
| ||||||||||||||||||||||||||||||||||||||||
| libunbound8 |
| ||||||||||||||||||||||||||||||||||||||||
| unbound-anchor |
| ||||||||||||||||||||||||||||||||||||||||
| unbound-devel |
|
References