CVE-2019-25031CWE-74

CVE-2019-25031

Medium · published April 27, 2021

CVSS v3.1
5.9
EPSS
2%
Percentile
76.7
In the wild
Unconfirmed
What it is

Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. create_unbound_ad_servers.sh is a contributed script from the community that facilitates automatic configuration creation. It is not part of the Unbound installation

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01675 · 76.7th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2021-04-27T10:15Z
Affected products (2)
ProductVersionsFixed in
nlnetlabs/unbound< 1.9.51.9.5
debian/debian_linuxall versions—
References (6)
https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html · [email protected]https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ · [email protected]https://security.netapp.com/advisory/ntap-20210507-0007/ · [email protected]https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html · af854a3a-2127-422b-91ae-364da2661108https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20210507-0007/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 27 APR 05:18Z
    Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session
    cvelistv5