Bug 872209 – <net-dns/unbound-1.16.3: non-responsive delegation attack

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2022-09-21 14:48:55 UTC]

"The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks."

Please bump to 1.16.3.

[Comment 1 Sam James 2022-10-08 21:34:24 UTC]

ping

[Comment 2 Larry the Git Cow 2022-10-12 14:30:19 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fdf645337b86cbdf011b6c6f5984eeb58e11b5ac

commit fdf645337b86cbdf011b6c6f5984eeb58e11b5ac
Author:     Marc Schiffbauer <[e-mail]>
AuthorDate: 2022-10-12 14:29:28 +0000
Commit:     Marc Schiffbauer <[e-mail]>
CommitDate: 2022-10-12 14:29:28 +0000

    net-dns/unbound: add 1.16.3, drop 1.16.2
    
    Bug: https://bugs.gentoo.org/872209
    Signed-off-by: Marc Schiffbauer <[e-mail]>

 net-dns/unbound/Manifest                                         | 4 ++--
 net-dns/unbound/{unbound-1.16.2.ebuild => unbound-1.16.3.ebuild} | 0
 2 files changed, 2 insertions(+), 2 deletions(-)

[Comment 3 John Helmert III 2022-10-12 14:55:40 UTC]

Please stabilize when ready.

[Comment 4 Sam James 2022-10-31 20:50:47 UTC]

Please cleanup, thanks!

[Comment 5 Larry the Git Cow 2022-11-22 18:41:11 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=be530e587fe23ead7b643f547a3d5e3be5623c32

commit be530e587fe23ead7b643f547a3d5e3be5623c32
Author:     John Helmert III <[e-mail]>
AuthorDate: 2022-11-22 18:38:32 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-11-22 18:40:57 +0000

    net-dns/unbound: drop 1.13.1-r3, 1.13.2-r1, 1.15.0, 1.16.0
    
    Bug: https://bugs.gentoo.org/872209
    Bug: https://bugs.gentoo.org/866881
    Signed-off-by: John Helmert III <[e-mail]>

 net-dns/unbound/Manifest                 |   6 -
 net-dns/unbound/unbound-1.13.1-r3.ebuild | 208 ------------------------------
 net-dns/unbound/unbound-1.13.2-r1.ebuild | 210 ------------------------------
 net-dns/unbound/unbound-1.15.0.ebuild    | 213 -------------------------------
 net-dns/unbound/unbound-1.16.0.ebuild    | 213 -------------------------------
 5 files changed, 850 deletions(-)

[Comment 6 John Helmert III 2022-11-22 18:42:29 UTC]

GLSA request filed

[Comment 7 Larry the Git Cow 2022-12-19 02:05:14 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=a8c88ef24b83e97ad8e1c9188236da95c32f0fe7

commit a8c88ef24b83e97ad8e1c9188236da95c32f0fe7
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-12-19 02:00:45 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-12-19 02:04:28 +0000

    [ GLSA 202212-02 ] Unbound: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/866881
    Bug: https://bugs.gentoo.org/872209
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202212-02.xml | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

[Comment 8 John Helmert III 2022-12-19 02:31:18 UTC]

GLSA released, all done.