CVE-2024-1488 : faille élevée fedoraproject unbound (CVSS 7.3)

Description

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.

En bref

Sévérité: Élevée (CVSS 7.3)
Vecteur CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Exploitation active: Non signalée par la CISA
Publication: 15 févr. 2024
Dernière mise à jour: 6 août 2026

Produits concernés

fedoraproject unbound
redhat codeready linux builder
redhat codeready linux builder eus
redhat codeready linux builder eus for power little endian
redhat codeready linux builder for arm64
redhat codeready linux builder for arm64 eus
redhat codeready linux builder for ibm z systems
redhat codeready linux builder for ibm z systems eus
redhat enterprise linux
redhat enterprise linux eus
redhat enterprise linux for arm 64
redhat enterprise linux for arm 64 eus
redhat enterprise linux for ibm z systems
redhat enterprise linux for ibm z systems eus
redhat enterprise linux for power little endian
redhat enterprise linux for power little endian eus
redhat enterprise linux server aus
redhat enterprise linux server for power little endian update services for sap solutions
redhat enterprise linux server tus

Description

En bref

Produits concernés

Références