rpms/unbound
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Ensure only unbound group members can make changes

Browse Source 
unbound-control should allow only privileged users from unbound group to
modify running instance.

; Resolves: CVE-2024-1488
Resolves: RHEL-25501
This commit is contained in:
Petr Menšík 2024-02-13 22:47:36 +01:00
parent 74bca6df28
commit f52cac55d8
2 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
unbound.conf
View File

@ -989,6 +989,7 @@ remote-control:
# Set to no and use an absolute path as control-interface to use # Set to no and use an absolute path as control-interface to use
# a unix local named pipe for unbound-control. # a unix local named pipe for unbound-control.
# For local sockets this option is ignored, and TLS is not used.
# control-use-cert: yes # control-use-cert: yes
# what interfaces are listened to for remote control. # what interfaces are listened to for remote control.
@ -997,14 +998,11 @@ remote-control:
# are not used for that, so key and cert files need not be present. # are not used for that, so key and cert files need not be present.
# control-interface: 127.0.0.1 # control-interface: 127.0.0.1
# control-interface: ::1 # control-interface: ::1
control-interface: "/run/unbound/control"
# port number for remote control operations. # port number for remote control operations.
# control-port: 8953 # control-port: 8953
# for localhost, you can disable use of TLS by setting this to "no"
# For local sockets this option is ignored, and TLS is not used.
control-use-cert: "no"
# Unbound server key file. # Unbound server key file.
server-key-file: "/etc/unbound/unbound_server.key" server-key-file: "/etc/unbound/unbound_server.key"

5
unbound.spec
View File

@ -30,7 +30,7 @@
Summary: Validating, recursive, and caching DNS(SEC) resolver Summary: Validating, recursive, and caching DNS(SEC) resolver
Name: unbound Name: unbound
Version: 1.16.2 Version: 1.16.2
Release: 6%{?extra_version:.%{extra_version}}%{?dist} Release: 7%{?extra_version:.%{extra_version}}%{?dist}
License: BSD License: BSD
Url: https://nlnetlabs.nl/projects/unbound/ Url: https://nlnetlabs.nl/projects/unbound/
Source: https://nlnetlabs.nl/downloads/%{name}/%{name}-%{version}%{?extra_version}.tar.gz Source: https://nlnetlabs.nl/downloads/%{name}/%{name}-%{version}%{?extra_version}.tar.gz
@ -451,6 +451,9 @@ popd
%attr(0644,root,root) %config %{_sysconfdir}/%{name}/root.key %attr(0644,root,root) %config %{_sysconfdir}/%{name}/root.key
%changelog %changelog
* Wed Feb 28 2024 Petr Menšík <pemensik@redhat.com> - 1.16.2-7
- Ensure only unbound group can change configuration (CVE-2024-1488)
* Fri Feb 16 2024 Tomas Korbar <tkorbar@redhat.com> - 1.16.2-6 * Fri Feb 16 2024 Tomas Korbar <tkorbar@redhat.com> - 1.16.2-6
- Fix KeyTrap - Extreme CPU consumption in DNSSEC validator CVE-2023-50387 - Fix KeyTrap - Extreme CPU consumption in DNSSEC validator CVE-2023-50387
- Fix Preparing an NSEC3 closest encloser proof can exhaust CPU resources CVE-2023-50868 - Fix Preparing an NSEC3 closest encloser proof can exhaust CPU resources CVE-2023-50868