CVE-2019-25031

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-27 · updated 2026-08-25
Weakness: CWE-74

Description

Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. create_unbound_ad_servers.sh is a contributed script from the community that facilitates automatic configuration creation. It is not part of the Unbound installation

Affected products

Debian Linux: 9.0
NLnet Labs Unbound: before 1.9.5 — fixed in 1.9.5

How to fix

Upgrade to a fixed version: NLnet Labs Unbound 1.9.5. Check the vendor advisory for mitigations.

References

https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html
https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/
https://security.netapp.com/advisory/ntap-20210507-0007/
https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html
https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/
https://security.netapp.com/advisory/ntap-20210507-0007/

Get alerted when CVE-2019-25031 or the next vulnerability affects your stack