PT-2024-2045 · Nlnet+2 · Unbound+2

Fredrik Pettai + 1 · Published 2024-03-07 · Updated 2025-02-03 · CVE-2024-1931

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Unbound versions 1.18.0 through 1.19.1

Description The issue is related to a denial of service vulnerability caused by an infinite loop in the code. This occurs when Unbound tries to trim extra text fields from EDE records to fit within the client's advertised buffer size, but due to an unchecked condition, the code can loop indefinitely. This happens when Unbound replies with attached EDE information on a positive reply and the client's buffer size is smaller than needed. The vulnerability can only be triggered when the 'ede: yes' option is used, which is a non-default configuration.

Recommendations For Unbound versions 1.18.0 through 1.19.1, update to version 1.19.2 or later to fix the code and avoid looping indefinitely. As a temporary workaround, consider disabling the 'ede: yes' option until a patch is available.

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

ALT-PU-2024-3769

ALT-PU-2024-3776

ALT-PU-2024-3780

ALT-PU-2024-3945

ALT-PU-2024-4896

BDU:2024-01923

CVE-2024-1931

OPENSUSE-SU-2024:13762-1

SUSE-SU-2025:20024-1

Affected Products

Alt Linux

Red Os

Unbound

References · 33

• https://ubuntu.com/security/CVE-2024-1931 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4VCBRQ7KMSIGBQ6A4SBL5PF326DIJIIV · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01923 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:13762-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/B2JUIFPA7H75Q2W3VXW2TUNHK6NVGOX4 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2024-1931 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:20024-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/RBR4H7RCVMJ6H76S4LLRSY5EBFTYWGXK · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-1931 · Vendor Advisory
• https://nlnetlabs.nl/downloads/unbound/CVE-2024-1931.txt · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-1931 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-1931 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-1931 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1931 · Security Note