Vulnerability · Published Nov 27, 2020 · Assigned by redhat

CVE-2020-10772

High 7.5

In plain English

A high-severity security flaw in unbound. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 72% of all known vulnerabilities).

Severity (CVSS NVD)7.5High

Exploit odds (30 days)1.3%top 28.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared to versions of Unbound that shipped before the mentioned erratum. This issue is about the incomplete fix for CVE-2020-12662, and it does not affect upstream versions of Unbound.

Affected products (as reported)

Vendor	Product	Versions
n/a	unbound	unbound-1.6.6-5.el7_8

Weakness: CWE-406

References

https://bugzilla.redhat.com/show_bug.cgi?id=1846026 x_refsource_MISC