Bug 26646 - unbound new security issues CVE-2020-1266[23]
Summary: unbound new security issues CVE-2020-1266[23]
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2020-05-19 19:52 CEST by David Walser
Modified: 2020-05-24 20:06 CEST (History)
5 users (show)

See Also:
Source RPM: unbound-1.10.0-1.mga8.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2020-05-19 19:52:40 CEST 
Upstream has issued an advisory today (May 19):
https://nlnetlabs.nl/downloads/unbound/CVE-2020-12662_2020-12663.txt

The issues are fixed upstream in 1.10.1.

Mageia 7 is also affected.
David Walser 2020-05-19 19:52:53 CEST

Status comment: (none) => Fixed upstream in 1.10.1
Whiteboard: (none) => MGA7TOO

Nicolas Lécureuil 2020-05-19 22:06:28 CEST

CC: (none) => mageia
Version: Cauldron => 7
Whiteboard: MGA7TOO => (none)

Comment 1 Nicolas Lécureuil 2020-05-19 22:09:03 CEST 
1.10.1 pushed into cauldron.
Comment 2 Nicolas Lécureuil 2020-05-19 22:28:02 CEST 
Advisory:
========================
Updated unbound packages fix security vulnerability:

- CVE-2020-12662 Unbound can be tricked into amplifying an incoming
  query into a large number of queries directed to a target.
- CVE-2020-12663 Malformed answers from upstream name servers can be
  used to make Unbound unresponsive.
References:
https://nlnetlabs.nl/downloads/unbound/CVE-2020-12662_2020-12663.txt

Updated packages in core/updates_testing:
========================
unbound-1.10.1-1.mga7
libunbound8-1.10.1-1.mga7
libunbound-devel-1.10.1-1.mga7
python2-unbound-1.10.1-1.mga7
python3-unbound-1.10.1-1.mga7
unbound-debuginfo-1.10.1-1.mga7
libunbound8-debuginfo-1.10.1-1.mga7
python2-unbound-debuginfo-1.10.1-1.mga7
python3-unbound-debuginfo-1.10.1-1.mga7

from:
unbound-1.10.1-1.mga7

Assignee: eatdirt => qa-bugs

David Walser 2020-05-19 23:50:19 CEST

Status comment: Fixed upstream in 1.10.1 => (none)

Comment 3 Herman Viaene 2020-05-20 13:51:27 CEST 
MGA7-64 Plasma on Lenovo B50
No installation issues omitting the devel and debug packages.
Ref bug 25974 Comment 1 for testing.
# systemctl  start unbound

# systemctl -l status unbound
● unbound.service - Unbound DNS Resolver
   Loaded: loaded (/usr/lib/systemd/system/unbound.service; disabled; vendor preset: disabled)
   Active: active (running) since Wed 2020-05-20 13:48:16 CEST; 18s ago
 Main PID: 8189 (unbound)
    Tasks: 1 (limit: 4915)
   Memory: 5.6M
   CGroup: /system.slice/unbound.service
           └─8189 /usr/sbin/unbound -c /etc/unbound/unbound.conf

May 20 13:48:16 mach5.hviaene.thuis systemd[1]: Started Unbound DNS Resolver.
May 20 13:48:16 mach5.hviaene.thuis unbound[8189]: [8189:0] notice: init module 0: validator
May 20 13:48:16 mach5.hviaene.thuis unbound[8189]: [8189:0] notice: init module 1: iterator
May 20 13:48:16 mach5.hviaene.thuis unbound[8189]: [8189:0] info: start of service (unbound 1.10.1).

OK.

Whiteboard: (none) => MGA7-64-OK
CC: (none) => herman.viaene

Comment 4 Thomas Andrews 2020-05-20 14:05:13 CEST 
Validating. Advisory in Comment 2.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Thomas Backlund 2020-05-24 17:56:06 CEST

Keywords: (none) => advisory
CC: (none) => tmb

Comment 5 Mageia Robot 2020-05-24 20:06:41 CEST 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2020-0224.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.