CVE-2022-30698

CVE-2022-30698: fallo en NLnet Labs Unbound

Novel "ghost domain names" attack by introducing subdomain delegations

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Unbound+ Monitorear unbound

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 1.2%
NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a subdomain of a rogue domain name. The rogue nameserver returns delegation information for the subdomain that updates Unbound's delegation cache. This action can be repeated before expiry of the delegation information by querying Unbound for a second level subdomain which the rogue nameserver provides new delegation information. Since Unbound is a child-centric resolver, the ever-updating child delegation information can keep a rogue domain name resolvable long after revocation. From version 1.16.2 on, Unbound checks the validity of parent delegation records before using cached delegation information.
Productos afectados
NLnet Labs · Unbound
CVEs relacionadas — NLnet Labs Unbound

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-1931HIGHDenial of service when trimming EDE text on positive repliesEPSS 2.5%CVE-2022-3204HIGHNRDelegation AttackEPSS 1.6%CVE-2026-33278CRITICALPossible arbitrary code execution during DNSSEC validationEPSS 1.4%CVE-2022-30699—Novel "ghost domain names" attack by updating almost expired delegation informationEPSS 1.2%CVE-2026-81642CRITICALHeap buffer overflow and possible Remote Code Execution when digesting DNSKEYEPSS 1.0%CVE-2026-42944HIGHHeap overflow with multiple NSID, COOKIE, PADDING EDNS optionsEPSS 0.8%