USN-6665-1: Unbound vulnerabilities

Severity

Medium

Vendor

Canonical Ubuntu

Description

Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered that Unbound incorrectly handled validating DNSSEC messages. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. (CVE-2023-50387) It was discovered that Unbound incorrectly handled preparing an NSEC3 closest encloser proof. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. (CVE-2023-50868) Update Instructions: Run `sudo pro fix USN-6665-1` to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: unbound – 1.9.4-2ubuntu1.5 python3-unbound – 1.9.4-2ubuntu1.5 libunbound8 – 1.9.4-2ubuntu1.5 python-unbound – 1.9.4-2ubuntu1.5 unbound-anchor – 1.9.4-2ubuntu1.5 unbound-host – 1.9.4-2ubuntu1.5 libunbound-dev – 1.9.4-2ubuntu1.5 No subscription required

CVEs contained in this USN include: CVE-2023-50387, CVE-2023-50868.

Affected Cloud Foundry Products and Versions

Severity is medium unless otherwise noted.

• cflinuxfs4
  • All versions prior to 1.79.0
• CF Deployment
  • All versions prior to 39.3.0

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below.

The Cloud Foundry project recommends upgrading the following releases:

• cflinuxfs4
  • Upgrade all versions to 1.79.0 or greater
• CF Deployment
  • Upgrade all versions to 39.3.0 or greater

History

2024-04-04: Initial vulnerability report published.