An update for unbound is now available for openEuler-22.03-LTS-SP1,openEuler-24.03-LTS,openEuler-22.03-LTS-SP4,openEuler-22.03-LTS-SP3,openEuler-20.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2024-2266 Final 1.0 1.0 2024-10-18 Initial 2024-10-18 2024-10-18 openEuler SA Tool V1.0 2024-10-18 unbound security update An update for unbound is now available for openEuler-22.03-LTS-SP1,openEuler-24.03-LTS,openEuler-22.03-LTS-SP4,openEuler-22.03-LTS-SP3,openEuler-20.03-LTS-SP4 Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only. Security Fix(es): NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression calculations it is willing to do per packet. Packets that need more compression will result in semi-compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long. This change should not affect normal DNS traffic.(CVE-2024-8508) An update for unbound is now available for openEuler-22.03-LTS-SP1,openEuler-24.03-LTS,openEuler-22.03-LTS-SP4,openEuler-22.03-LTS-SP3,openEuler-20.03-LTS-SP4. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium unbound https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2266 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-8508 https://nvd.nist.gov/vuln/detail/CVE-2024-8508 openEuler-22.03-LTS-SP1 openEuler-24.03-LTS openEuler-22.03-LTS-SP4 openEuler-22.03-LTS-SP3 openEuler-20.03-LTS-SP4 unbound-1.13.2-15.oe2203sp1.src.rpm unbound-1.17.1-10.oe2403.src.rpm unbound-1.13.2-16.oe2203sp4.src.rpm unbound-1.13.2-16.oe2203sp3.src.rpm unbound-1.11.0-16.oe2003sp4.src.rpm python3-unbound-1.13.2-15.oe2203sp1.aarch64.rpm unbound-1.13.2-15.oe2203sp1.aarch64.rpm unbound-debuginfo-1.13.2-15.oe2203sp1.aarch64.rpm unbound-debugsource-1.13.2-15.oe2203sp1.aarch64.rpm unbound-devel-1.13.2-15.oe2203sp1.aarch64.rpm unbound-help-1.13.2-15.oe2203sp1.aarch64.rpm unbound-libs-1.13.2-15.oe2203sp1.aarch64.rpm python3-unbound-1.17.1-10.oe2403.aarch64.rpm unbound-1.17.1-10.oe2403.aarch64.rpm unbound-anchor-1.17.1-10.oe2403.aarch64.rpm unbound-debuginfo-1.17.1-10.oe2403.aarch64.rpm unbound-debugsource-1.17.1-10.oe2403.aarch64.rpm unbound-devel-1.17.1-10.oe2403.aarch64.rpm unbound-help-1.17.1-10.oe2403.aarch64.rpm unbound-libs-1.17.1-10.oe2403.aarch64.rpm unbound-utils-1.17.1-10.oe2403.aarch64.rpm python3-unbound-1.13.2-16.oe2203sp4.aarch64.rpm unbound-1.13.2-16.oe2203sp4.aarch64.rpm unbound-anchor-1.13.2-16.oe2203sp4.aarch64.rpm unbound-debuginfo-1.13.2-16.oe2203sp4.aarch64.rpm unbound-debugsource-1.13.2-16.oe2203sp4.aarch64.rpm unbound-devel-1.13.2-16.oe2203sp4.aarch64.rpm unbound-help-1.13.2-16.oe2203sp4.aarch64.rpm unbound-libs-1.13.2-16.oe2203sp4.aarch64.rpm python3-unbound-1.13.2-16.oe2203sp3.aarch64.rpm unbound-1.13.2-16.oe2203sp3.aarch64.rpm unbound-anchor-1.13.2-16.oe2203sp3.aarch64.rpm unbound-debuginfo-1.13.2-16.oe2203sp3.aarch64.rpm unbound-debugsource-1.13.2-16.oe2203sp3.aarch64.rpm unbound-devel-1.13.2-16.oe2203sp3.aarch64.rpm unbound-help-1.13.2-16.oe2203sp3.aarch64.rpm unbound-libs-1.13.2-16.oe2203sp3.aarch64.rpm python3-unbound-1.11.0-16.oe2003sp4.aarch64.rpm unbound-1.11.0-16.oe2003sp4.aarch64.rpm unbound-debuginfo-1.11.0-16.oe2003sp4.aarch64.rpm unbound-debugsource-1.11.0-16.oe2003sp4.aarch64.rpm unbound-devel-1.11.0-16.oe2003sp4.aarch64.rpm unbound-help-1.11.0-16.oe2003sp4.aarch64.rpm unbound-libs-1.11.0-16.oe2003sp4.aarch64.rpm python3-unbound-1.13.2-15.oe2203sp1.x86_64.rpm unbound-1.13.2-15.oe2203sp1.x86_64.rpm unbound-debuginfo-1.13.2-15.oe2203sp1.x86_64.rpm unbound-debugsource-1.13.2-15.oe2203sp1.x86_64.rpm unbound-devel-1.13.2-15.oe2203sp1.x86_64.rpm unbound-help-1.13.2-15.oe2203sp1.x86_64.rpm unbound-libs-1.13.2-15.oe2203sp1.x86_64.rpm python3-unbound-1.17.1-10.oe2403.x86_64.rpm unbound-1.17.1-10.oe2403.x86_64.rpm unbound-anchor-1.17.1-10.oe2403.x86_64.rpm unbound-debuginfo-1.17.1-10.oe2403.x86_64.rpm unbound-debugsource-1.17.1-10.oe2403.x86_64.rpm unbound-devel-1.17.1-10.oe2403.x86_64.rpm unbound-help-1.17.1-10.oe2403.x86_64.rpm unbound-libs-1.17.1-10.oe2403.x86_64.rpm unbound-utils-1.17.1-10.oe2403.x86_64.rpm python3-unbound-1.13.2-16.oe2203sp4.x86_64.rpm unbound-1.13.2-16.oe2203sp4.x86_64.rpm unbound-anchor-1.13.2-16.oe2203sp4.x86_64.rpm unbound-debuginfo-1.13.2-16.oe2203sp4.x86_64.rpm unbound-debugsource-1.13.2-16.oe2203sp4.x86_64.rpm unbound-devel-1.13.2-16.oe2203sp4.x86_64.rpm unbound-help-1.13.2-16.oe2203sp4.x86_64.rpm unbound-libs-1.13.2-16.oe2203sp4.x86_64.rpm python3-unbound-1.13.2-16.oe2203sp3.x86_64.rpm unbound-1.13.2-16.oe2203sp3.x86_64.rpm unbound-anchor-1.13.2-16.oe2203sp3.x86_64.rpm unbound-debuginfo-1.13.2-16.oe2203sp3.x86_64.rpm unbound-debugsource-1.13.2-16.oe2203sp3.x86_64.rpm unbound-devel-1.13.2-16.oe2203sp3.x86_64.rpm unbound-help-1.13.2-16.oe2203sp3.x86_64.rpm unbound-libs-1.13.2-16.oe2203sp3.x86_64.rpm python3-unbound-1.11.0-16.oe2003sp4.x86_64.rpm unbound-1.11.0-16.oe2003sp4.x86_64.rpm unbound-debuginfo-1.11.0-16.oe2003sp4.x86_64.rpm unbound-debugsource-1.11.0-16.oe2003sp4.x86_64.rpm unbound-devel-1.11.0-16.oe2003sp4.x86_64.rpm unbound-help-1.11.0-16.oe2003sp4.x86_64.rpm unbound-libs-1.11.0-16.oe2003sp4.x86_64.rpm NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression calculations it is willing to do per packet. Packets that need more compression will result in semi-compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long. This change should not affect normal DNS traffic. 2024-10-18 CVE-2024-8508 openEuler-22.03-LTS-SP1 openEuler-24.03-LTS openEuler-22.03-LTS-SP4 openEuler-22.03-LTS-SP3 openEuler-20.03-LTS-SP4 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L unbound security update 2024-10-18 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2266