REDHAT-BUG-2503063: High severity Unbound vulnerability
Insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains. Unbound 1.25.2 includes fixes to add lower-bound check in RRSIG labels, move cache write stricly after validation and adding bailiwick check when updating wildcards.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Unboundto a version that resolves this vulnerability.Fixed in 1.25.2
Event History
Frequently Asked Questions
What level of attacker access is required to exploit this issue?
The attacker must control a single delegated DNS zone. Exploitation targets sibling zones under a parent domain that is NSEC-signed.
Which Unbound release includes the fixes?
Unbound 1.25.2 includes the fixes described for this issue.
What protections were added in the fixed release?
The fixes add a lower-bound check for RRSIG Labels, defer cache writes until after validation, and add a bailiwick check when updating wildcards.