Resource exhaustion in Unbound - CVE-2024-8508

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU98049

Resource exhaustion in Unbound - CVE-2024-8508

Published: October 5, 2024 / Updated: October 14, 2024


Vulnerability identifier: #VU98049
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-8508
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling replies with very large RRsets. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

Unbound
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Micro
OpenBSD
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Ubuntu
SUSE Package Hub 15
Basesystem Module
openSUSE Leap
openEuler
Fedora
LANTIME Operating System Firmware (LTOS)
IBM Qradar SIEM
libunbound2 (Ubuntu package)
unbound (Ubuntu package)
libunbound8 (Ubuntu package)
unbound
python3-unbound
unbound-debuginfo
unbound-debugsource
unbound-devel
unbound-help
unbound-libs
unbound-anchor
unbound (Red Hat package)
unbound (Debian package)
unbound-utils
unbound-python-debuginfo
unbound-python
unbound-anchor-debuginfo
unbound-munin
libunbound8
libunbound8-debuginfo
libunbound-devel-mini
libunbound-devel-mini-debuginfo
libunbound-devel-mini-debugsource
Submariner
Red Hat OpenShift Container Platform
OpenShift Virtualization
Juniper Secure Analytics (JSA)

How to mitigate CVE-2024-8508

Install updates from vendor's website.

Unbound - update to 1.21.1
LANTIME Operating System Firmware (LTOS) - update to 7.08.020
IBM Qradar SIEM - update to 7.5.0 Update Pack 11 IF01
libunbound2 (Ubuntu package) - update to Ubuntu Pro
unbound (Ubuntu package) - addressed in versions Ubuntu Pro, 1.9.4-2ubuntu1.9, 1.13.1-1ubuntu5.8, 1.19.2-1ubuntu3.3, 1.20.0-1ubuntu2.1
Submariner - update to 0.18.5
libunbound8 (Ubuntu package) - addressed in versions 1.9.4-2ubuntu1.9, 1.13.1-1ubuntu5.8, 1.19.2-1ubuntu3.3, 1.20.0-1ubuntu2.1
unbound - addressed in versions 1.11.0-23, 1.13.2-15, 1.13.2-23, 1.17.1-17
python3-unbound - addressed in versions 1.11.0-23, 1.13.2-15, 1.13.2-23, 1.17.1-17
unbound-debuginfo - addressed in versions 1.11.0-23, 1.13.2-15, 1.13.2-23, 1.17.1-17
unbound-debugsource - addressed in versions 1.11.0-23, 1.13.2-15, 1.13.2-23, 1.17.1-17
unbound-devel - addressed in versions 1.11.0-23, 1.13.2-15, 1.13.2-23, 1.17.1-17
unbound-help - addressed in versions 1.11.0-23, 1.13.2-15, 1.13.2-23, 1.17.1-17
unbound-libs - addressed in versions 1.11.0-23, 1.13.2-15, 1.13.2-23, 1.17.1-17
unbound-anchor - addressed in versions 1.13.2-23, 1.17.1-17
unbound (Red Hat package) - addressed in versions 1.16.2-5.8.el8_10, 1.16.2-8.el9_4.1, 1.16.2-8.el9_5.1, 1.16.2-18.el9_6, 1.20.0-10.el10_0
unbound-libs - addressed in versions 1.16.2-8, 1.16.2-9.0.2, 1.17.1-4
python3-unbound - addressed in versions 1.16.2-8, 1.16.2-9.0.2, 1.17.1-4
unbound - addressed in versions 1.16.2-8, 1.16.2-9.0.2, 1.17.1-4
unbound-devel - addressed in versions 1.16.2-8, 1.16.2-9.0.2, 1.17.1-4
unbound (Debian package) - update to 1.17.1-2+deb12u3
unbound-anchor - update to 1.17.1-4
unbound-utils - update to 1.17.1-4
unbound-utils - update to 1.17.1-17
unbound-python-debuginfo - addressed in versions 1.20.0-150100.10.19.1, 1.20.0-150600.23.9.1
unbound - addressed in versions 1.20.0-150100.10.19.1, 1.20.0-150600.23.9.1
unbound-debugsource - addressed in versions 1.20.0-150100.10.19.1, 1.20.0-150600.23.9.1
unbound-python - addressed in versions 1.20.0-150100.10.19.1, 1.20.0-150600.23.9.1
unbound-anchor-debuginfo - addressed in versions 1.20.0-150100.10.19.1, 1.20.0-150600.23.9.1
unbound-munin - addressed in versions 1.20.0-150100.10.19.1, 1.20.0-150600.23.9.1
unbound-debuginfo - addressed in versions 1.20.0-150100.10.19.1, 1.20.0-150600.23.9.1
unbound-devel - addressed in versions 1.20.0-150100.10.19.1, 1.20.0-150600.23.9.1
libunbound8 - addressed in versions 1.20.0-150100.10.19.1, 1.20.0-150600.23.9.1
libunbound8-debuginfo - addressed in versions 1.20.0-150100.10.19.1, 1.20.0-150600.23.9.1
unbound-anchor - addressed in versions 1.20.0-150100.10.19.1, 1.20.0-150600.23.9.1
libunbound-devel-mini - update to 1.20.0-150600.23.9.1
libunbound-devel-mini-debuginfo - update to 1.20.0-150600.23.9.1
libunbound-devel-mini-debugsource - update to 1.20.0-150600.23.9.1
unbound - addressed in versions 1.21.1-1.fc41, 1.21.1-3.fc39, 1.21.1-3.fc40
Red Hat OpenShift Container Platform - addressed in versions 4.14.48, 4.16.30, 4.17.16
OpenShift Virtualization - update to 4.17.3
Juniper Secure Analytics (JSA) - update to 7.5.0 UP11 IF03

External References

Related Security Bulletins