unbound 1.13.1-1+deb11u1 source package in Debian

Changelog

unbound (1.13.1-1+deb11u1) bullseye; urgency=high

  * Non-maintainer upload by the LTS team.
  * Fix the following security vulnerabilities.
    CVE-2022-3204:
    A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation
    Attack) has been discovered in various DNS resolving software. The
    NRDelegation Attack works by having a malicious delegation with a
    considerable number of non responsive nameservers. The attack starts by
    querying a resolver for a record that relies on those unresponsive
    nameservers. The attack can cause a resolver to spend a lot of
    time/resources resolving records under a malicious delegation point where a
    considerable number of unresponsive NS records reside. It can trigger high
    CPU usage in some resolver implementations that continually look in the
    cache for resolved NS records in that delegation. This can lead to degraded
    performance and eventually denial of service in orchestrated attacks.
    Unbound does not suffer from high CPU usage, but resources are still needed
    for resolving the malicious delegation. Unbound will keep trying to resolve
    the record until hard limits are reached. Based on the nature of the attack
    and the replies, different limits could be reached. From now on Unbound
    introduces fixes for better performance when under load, by cutting
    opportunistic queries for nameserver discovery and DNSKEY prefetching and
    limiting the number of times a delegation point can issue a cache lookup
    for missing records.
  * CVE-2022-30698 and CVE-2022-30699: (Closes: #1016493)
    Unbound is vulnerable to a novel type of the "ghost domain names" attack.
    The vulnerability works by targeting an Unbound instance.  Unbound is
    queried for a rogue domain name when the cached delegation information is
    about to expire. The rogue nameserver delays the response so that the
    cached delegation information is expired. Upon receiving the delayed answer
    containing the delegation information, Unbound overwrites the now expired
    entries. This action can be repeated when the delegation information is
    about to expire making the rogue delegation information ever-updating. From
    now on Unbound stores the start time for a query and uses that to decide if
    the cached delegation information can be overwritten.

 -- Markus Koschany <email address hidden>  Wed, 05 Apr 2023 23:06:47 +0200

Upload details

Uploaded by:
unbound packagers
Uploaded to:
Bullseye
Original maintainer:
unbound packagers
Architectures:
any
Section:
net
Urgency:
Very Urgent

See full publishing history Publishing

Series Pocket Published Component Section
Bullseye release main net

Builds

Downloads

File Size SHA-256 Checksum
unbound_1.13.1-1+deb11u1.dsc 3.1 KiB af4c16c1dcdb4ddbb60fc7fa2fe927d1e80551dfb60cc19f75adcece33a0f76c
unbound_1.13.1.orig.tar.gz 5.7 MiB 8504d97b8fc5bd897345c95d116e0ee0ddf8c8ff99590ab2b4bd13278c9f50b8
unbound_1.13.1.orig.tar.gz.asc 833 bytes 1ca1fb3db4baa3e831bc42fcecf3eaceb316abf7a2d816dc46d0efcd199f419e
unbound_1.13.1-1+deb11u1.debian.tar.xz 28.8 KiB 0e47998afdcb29066c559031c374a3d8eb5b7a7e850a7e347b89304882fcf859

No changes file available.

Binary packages built by this source