// For flags

CVE-2020-10772

unbound: incomplete fix for CVE-2020-12662 in RHEL7

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared to versions of Unbound that shipped before the mentioned erratum. This issue is about the incomplete fix for CVE-2020-12662, and it does not affect upstream versions of Unbound.

Una corrección incompleta fue entregada para CVE-2020-12662 para Unbound en Red Hat Enterprise Linux versión 7, como parte de la errata de RHSA-2020: 2414. Las versiones vulnerables de Unbound aún podrían amplificar una consulta entrante en una gran cantidad de consultas dirigidas a un objetivo, inclusive con un índice de amplificación más bajo en comparación con las versiones de Unbound que se enviaron antes de la errata mencionada. Este problema se trata de la corrección incompleta para el CVE-2020-12662 y no afecta a las versiones anteriores de Unbound

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-03-20 CVE Reserved
  • 2020-06-22 CVE Published
  • 2023-08-13 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-400: Uncontrolled Resource Consumption
  • CWE-406: Insufficient Control of Network Message Volume (Network Amplification)
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Nlnetlabs
Search vendor "Nlnetlabs"
 Unbound
Search vendor "Nlnetlabs" for product "Unbound"
 1.6.6-5
Search vendor "Nlnetlabs" for product "Unbound" and version "1.6.6-5"
-
Affected
in Redhat
Search vendor "Redhat"
 Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
 7.0
Search vendor "Redhat" for product "Enterprise Linux" and version "7.0"
-
Safe