libunbound8-1.16.3-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:12368 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z libunbound8-1.16.3-1.1 on GA media These are all security issues fixed in the libunbound8-1.16.3-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-12368 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:12368 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2022-3204/ SUSE CVE CVE-2022-3204 page openSUSE Tumbleweed libunbound8-1.16.3-1.1 python3-unbound-1.16.3-1.1 unbound-1.16.3-1.1 unbound-anchor-1.16.3-1.1 unbound-devel-1.16.3-1.1 unbound-munin-1.16.3-1.1 libunbound8-1.16.3-1.1 as a component of openSUSE Tumbleweed python3-unbound-1.16.3-1.1 as a component of openSUSE Tumbleweed unbound-1.16.3-1.1 as a component of openSUSE Tumbleweed unbound-anchor-1.16.3-1.1 as a component of openSUSE Tumbleweed unbound-devel-1.16.3-1.1 as a component of openSUSE Tumbleweed unbound-munin-1.16.3-1.1 as a component of openSUSE Tumbleweed A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying to resolve the record until hard limits are reached. Based on the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance when under load, by cutting opportunistic queries for nameserver discovery and DNSKEY prefetching and limiting the number of times a delegation point can issue a cache lookup for missing records. CVE-2022-3204 openSUSE Tumbleweed:libunbound8-1.16.3-1.1 openSUSE Tumbleweed:python3-unbound-1.16.3-1.1 openSUSE Tumbleweed:unbound-1.16.3-1.1 openSUSE Tumbleweed:unbound-anchor-1.16.3-1.1 openSUSE Tumbleweed:unbound-devel-1.16.3-1.1 openSUSE Tumbleweed:unbound-munin-1.16.3-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-3204.html CVE-2022-3204 https://bugzilla.suse.com/1203643 SUSE Bug 1203643