Bugzilla – Bug 1185382
VUL-0: CVE-2019-25031: unbound: configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack
Last modified: 2022-09-15 12:35:01 UTC
CVE-2019-25031 Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. Upstream commit: f887552763477a606a9608b0f6b498685e0f6587 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-25031 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25031 https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ https://ostif.org/wp-content/uploads/2019/12/X41-Unbound-Security-Audit-2019-Final-Report.pdf
Tried to submit for SLE-15 as well SLE-15-SP2 but see WARNING: WARNING: Project does not accept submit request, a NEW maintenance incident request will be created instead WARNING: Server returned an error: HTTP Error 500: Internal Server Error Request: https://api.suse.de/request?cmd=create&addrevision=1 Headers: Date: Mon, 17 Jan 2022 13:46:28 GMT Server: Apache/2.4.43 (Linux/SUSE) Strict-Transport-Security: max-age=31536000 x-request-id: 58f602e7-4d7a-45fc-b899-481b4c88365b x-runtime: 1.143972 x-powered-by: Phusion Passenger(R) 6.0.12 content-length: 131 status: 500 Internal Server Error content-type: application/xml; charset=utf-8 Connection: close
Ah ... now it had worked out #SR262368 for SLE-15 and SR#262370 for SLE-15-SP1
Could anyone explain why I see this * **planned_fixes**: Fixes for unbound bugs bnc#1179191, bnc#1115417, bnc#1112033 are missing or not referenced (WARN) and indeed the package of both SLE-15 and SLE-15-SP1 do miss those fixes ... why I can not check out the correct versions?
Now see latest submission requests for SLE-15 and SLS-15-SP1.
openSUSE-SU-2022:0176-1: An update that solves 13 vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1076963,1112009,1112033,1179191,1185382,1185383,1185384,1185385,1185386,1185387,1185388,1185389,1185390,1185391,1185392,1185393 CVE References: CVE-2019-25031,CVE-2019-25032,CVE-2019-25033,CVE-2019-25034,CVE-2019-25035,CVE-2019-25036,CVE-2019-25037,CVE-2019-25038,CVE-2019-25039,CVE-2019-25040,CVE-2019-25041,CVE-2019-25042,CVE-2020-28935 JIRA References: Sources used: openSUSE Leap 15.4 (src): unbound-1.6.8-10.6.1 openSUSE Leap 15.3 (src): unbound-1.6.8-10.6.1
SUSE-SU-2022:0176-1: An update that solves 13 vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1076963,1112009,1112033,1179191,1185382,1185383,1185384,1185385,1185386,1185387,1185388,1185389,1185390,1185391,1185392,1185393 CVE References: CVE-2019-25031,CVE-2019-25032,CVE-2019-25033,CVE-2019-25034,CVE-2019-25035,CVE-2019-25036,CVE-2019-25037,CVE-2019-25038,CVE-2019-25039,CVE-2019-25040,CVE-2019-25041,CVE-2019-25042,CVE-2020-28935 JIRA References: Sources used: SUSE Manager Server 4.1 (src): unbound-1.6.8-10.6.1 SUSE Manager Retail Branch Server 4.1 (src): unbound-1.6.8-10.6.1 SUSE Manager Proxy 4.1 (src): unbound-1.6.8-10.6.1 SUSE Linux Enterprise Server for SAP 15-SP2 (src): unbound-1.6.8-10.6.1 SUSE Linux Enterprise Server for SAP 15-SP1 (src): unbound-1.6.8-10.6.1 SUSE Linux Enterprise Server 15-SP2-LTSS (src): unbound-1.6.8-10.6.1 SUSE Linux Enterprise Server 15-SP2-BCL (src): unbound-1.6.8-10.6.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): unbound-1.6.8-10.6.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): unbound-1.6.8-10.6.1 SUSE Linux Enterprise Module for Basesystem 15-SP4 (src): unbound-1.6.8-10.6.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): unbound-1.6.8-10.6.1 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src): unbound-1.6.8-10.6.1 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src): unbound-1.6.8-10.6.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): unbound-1.6.8-10.6.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): unbound-1.6.8-10.6.1 SUSE Enterprise Storage 7 (src): unbound-1.6.8-10.6.1 SUSE Enterprise Storage 6 (src): unbound-1.6.8-10.6.1 SUSE CaaS Platform 4.0 (src): unbound-1.6.8-10.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:0301-1: An update that solves 13 vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1076963,1112009,1112033,1179191,1185382,1185383,1185384,1185385,1185386,1185387,1185388,1185389,1185390,1185391,1185392,1185393 CVE References: CVE-2019-25031,CVE-2019-25032,CVE-2019-25033,CVE-2019-25034,CVE-2019-25035,CVE-2019-25036,CVE-2019-25037,CVE-2019-25038,CVE-2019-25039,CVE-2019-25040,CVE-2019-25041,CVE-2019-25042,CVE-2020-28935 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15 (src): unbound-1.6.8-3.9.1 SUSE Linux Enterprise Server 15-LTSS (src): unbound-1.6.8-3.9.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): unbound-1.6.8-3.9.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): unbound-1.6.8-3.9.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:0176-2: An update that solves 13 vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1076963,1112009,1112033,1179191,1185382,1185383,1185384,1185385,1185386,1185387,1185388,1185389,1185390,1185391,1185392,1185393 CVE References: CVE-2019-25031,CVE-2019-25032,CVE-2019-25033,CVE-2019-25034,CVE-2019-25035,CVE-2019-25036,CVE-2019-25037,CVE-2019-25038,CVE-2019-25039,CVE-2019-25040,CVE-2019-25041,CVE-2019-25042,CVE-2020-28935 JIRA References: Sources used: SUSE Linux Enterprise Realtime Extension 15-SP2 (src): unbound-1.6.8-10.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Released.