unbound-1.16.2-5.12.el8_10
エラータID: AXSA:2026-1249:07
リリース日:
2026/07/13 Monday - 17:12
題名:
unbound-1.16.2-5.12.el8_10
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Unbound には、キャッシュされた NS レコードが上書きされる問題が
あるため、リモートの攻撃者により、キャッシュポイズニングを可能と
する脆弱性が存在します。(CVE-2026-40622)
- Unbound には、ループ内で過剰にプラットフォームリソースを消費
してしまう問題があるため、リモートの攻撃者により、サービス拒否
攻撃を可能とする脆弱性が存在します。(CVE-2026-41292)
- Unbound には、リモートの攻撃者により、サービス拒否攻撃を可能
とする脆弱性が存在します。(CVE-2026-42534)
- Unbound には、ループ内で過剰にプラットフォームリソースを消費
してしまう問題があるため、リモートの攻撃者により、サービス拒否
(DoS) 状態を可能とする脆弱性が存在します。(CVE-2026-44390)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-40622
NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.
NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.
CVE-2026-41292
NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch with a fix to limit acceptable incoming EDNS options (100).
NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch with a fix to limit acceptable incoming EDNS options (100).
CVE-2026-42534
NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle logic to see them as aged and potential targets for replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain name server that replies slowly and/or maliciously to Unbound's queries can exploit the vulnerability and degrade the resolution performance of Unbound. When Unbound's 'num-queries-per-thread' reaches its limit, the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the original one that started the resolution effort. Cache and local data response performance remains unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1 contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow the jostle logic to work as intended.
NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle logic to see them as aged and potential targets for replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain name server that replies slowly and/or maliciously to Unbound's queries can exploit the vulnerability and degrade the resolution performance of Unbound. When Unbound's 'num-queries-per-thread' reaches its limit, the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the original one that started the resolution effort. Cache and local data response performance remains unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1 contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow the jostle logic to work as intended.
CVE-2026-44390
NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very large RRsets with records that don't share a suffix above the root can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. An adversary can exploit the vulnerability by querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. A compression limit was introduced in 1.21.1 for this but it didn't account for the case where records would not share any suffix above the root. That causes Unbound to go in a different code path because of the compression tree lookup failure and eventually not increment the compression counter for those operations. Unbound 1.25.1 contains a patch with a fix that increments the compression counter regardless of the compression tree lookup. This is a complement fix to CVE-2024-8508.
NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression for. Malicious upstream responses with very large RRsets with records that don't share a suffix above the root can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. An adversary can exploit the vulnerability by querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. A compression limit was introduced in 1.21.1 for this but it didn't account for the case where records would not share any suffix above the root. That causes Unbound to go in a different code path because of the compression tree lookup failure and eventually not increment the compression counter for those operations. Unbound 1.25.1 contains a patch with a fix that increments the compression counter regardless of the compression tree lookup. This is a complement fix to CVE-2024-8508.
追加情報:
N/A
ダウンロード:
SRPMS
- unbound-1.16.2-5.12.el8_10.src.rpm
MD5: fa17076adfcbb7cbfc5b7ea70496a1f9
SHA-256: 14e3d408714e6453dd181cda2663d3b37d1065f079ff454a653dee4f3835cec6
Size: 6.03 MB
Asianux Server 8 for x86_64
- python3-unbound-1.16.2-5.12.el8_10.x86_64.rpm
MD5: 1333635e1dbf577afd368638288c7f5b
SHA-256: bb34a197e971fea0ab47a0658cce4274328948ccb4d8673a9882f38e133cfdfe
Size: 129.71 kB - unbound-1.16.2-5.12.el8_10.x86_64.rpm
MD5: d30be0bdaf8aa48d2d4e2d760763111d
SHA-256: 403db2d5e209bcd7828d47c50c1f7d4d5ba976370c3df7d7668c4a2277f24528
Size: 1.00 MB - unbound-devel-1.16.2-5.12.el8_10.i686.rpm
MD5: 508b7bd0bd78f0080c9223f5b378beae
SHA-256: 926ce3866270e030a0f4df26814f0cc05e798918ebda27f62c4c5f7623949c8c
Size: 57.11 kB - unbound-devel-1.16.2-5.12.el8_10.x86_64.rpm
MD5: cb6bebe1b1e34c8c1a56f44cbfd37ae2
SHA-256: 05b3d3019e5a4d330c5c7b2dfa4c09dbe7ce7e7991c7e2b8069fea50976033cd
Size: 57.09 kB - unbound-libs-1.16.2-5.12.el8_10.i686.rpm
MD5: f601164f39cdb718031ff197892f8978
SHA-256: a2d84eb232261f91afbd0f781eefccc7f720d95b0f22d8d348102a2fc5898704
Size: 618.27 kB - unbound-libs-1.16.2-5.12.el8_10.x86_64.rpm
MD5: dbe88f6e965c939321379104635bd22b
SHA-256: f330b366fadc0e850a84c39993c0a32081c2b913d0f78390e580d51d04b5e17b
Size: 577.93 kB
English