An unbound security, bug fix, and enhancement update has been released for AlmaLinux.

ALSA-2021:1853 Moderate: unbound security, bug fix, and enhancement update

Type:
security

Severity:
moderate

Release date:
2021-05-18

Description
Security Fix(es):
* unbound: integer overflow in the regional allocator via regional_alloc (CVE-2019-25032)
* unbound: integer overflow in sldns_str2wire_dname_buf_origin can lead to an out-of-bounds write (CVE-2019-25034)
* unbound: out-of-bounds write in sldns_bget_token_par (CVE-2019-25035)
* unbound: assertion failure and denial of service in synth_cname (CVE-2019-25036)
* unbound: assertion failure and denial of service in dname_pkt_copy via an invalid packet (CVE-2019-25037)
* unbound: integer overflow in a size calculation in dnscrypt/dnscrypt.c (CVE-2019-25038)
* unbound: integer overflow in a size calculation in respip/respip.c (CVE-2019-25039)
* unbound: infinite loop via a compressed name in dname_pkt_copy (CVE-2019-25040)
* unbound: assertion failure via a compressed name in dname_pkt_copy (CVE-2019-25041)
* unbound: out-of-bounds write via a compressed name in rdata_copy (CVE-2019-25042)
* unbound: symbolic link traversal when writing PID file (CVE-2020-28935)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

References:
CVE-2019-25032
CVE-2019-25034
CVE-2019-25035
CVE-2019-25036
CVE-2019-25037
CVE-2019-25038
CVE-2019-25039
CVE-2019-25040
CVE-2019-25041
CVE-2019-25042
CVE-2020-28935

Updates packages:
unbound-1.7.3-15.el8.x86_64.rpm
unbound-devel-1.7.3-15.el8.i686.rpm
unbound-devel-1.7.3-15.el8.x86_64.rpm

Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

  ALSA-2021:1853 Moderate: unbound security, bug fix, and enhancement update