Debian alert DLA-3952-1 (unbound)

From:
             
 
Daniel Leidert <dleidert@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 3952-1] unbound security update
Date:
             
 
Thu, 14 Nov 2024 19:58:58 +0100
Message-ID:
             
 
<25e294a59269779c454b3155b9276f71075f7a1e.camel@debian.org>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-3952-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Daniel Leidert
November 14, 2024                             https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : unbound
Version        : 1.13.1-1+deb11u4
CVE ID         : CVE-2024-8508
Debian Bug     : 1083282

A vulnerability has been discovered in unbound, a validating,
recursive, caching DNS resolver. Malicious upstreams responses with
very large RRsets can cause Unbound to spend a considerable time
applying name compression to downstream replies. This can lead to
degraded performance and eventually denial of service in well
orchestrated attacks. The vulnerability can be exploited by a malicious
actor querying Unbound for the specially crafted contents of a
malicious zone with very large RRsets.

For Debian 11 bullseye, this problem has been fixed in version
1.13.1-1+deb11u4.

We recommend that you upgrade your unbound packages.

For the detailed security status of unbound please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/unbound

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS



Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQJIBAABCgAyFiEEvu1N7VVEpMA+KD3HS80FZ8KW0F0FAmc2SHIUHGRsZWlkZXJ0
QGRlYmlhbi5vcmcACgkQS80FZ8KW0F2Ztg/8CgxXNglq/MQFTNDi709iK6/HtFgk
vXncD+uDCDjvArdAn/KKBP3jARoP0dNp63M0Bi7mgU0vt97BSvBRqNfTCtphk3oa
vtifob6fy/ziU1JYWKPEUrHyNuwBCTuWoJSfDbCbMrXR+14F3WLIidtymUdlSJ8e
lAn/t4APSNFscllSPbALuZ/wUO0IrL3GUjtnX+UXc0oj0Im9dUX3VJ+TUMMzz6ew
4cHcNTxi/MkkyvQfgVIWYhcUIxlxTwuzacIyAj82+0/AAPFDsaOLuamES3OkLzZN
oZtJZlShKfigt5ZM7VN6UU8gQZ4juSXCMYdQ4bES6m9oZB3I56US7pq064hr70XC
8GklIG3Hq0+YHxMpNilfkF55IyWK4ZkJfDrZs0I5ka0FSakP1NhW/sFbZVV0/P3R
Q7VREjFqBuEEEksv2W/rY9F1QZIrMfnSokzQzaw+WBeGjEcYlqx5MSUmYxU1du6E
9nTPcwtPufKbZcgo8WFm9321P//FYCzD1RqWrBTaYtTh5pJD92lc6gkQAJaEBJaT
b5TrglyL5HvwKTOPioWueS3aL1sT2I11j7/mbddDd9ptTuC4vk0RcwH4OgtxucFI
FdhbtLUl5f8GRYmrjyPtvqC/CECp38FDYKWFxIVHFHVfDFbTD9m4MGDawiKIRXSM
snKE/ToNIKyQXho=
=nc0s
-----END PGP SIGNATURE-----