CVE-2019-18934 Command injection in n/a
Attackers can execute arbitrary shell code on Unbound DNS servers if the ipsecmod feature is enabled and used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-18934?
CVE-2019-18934 is a high-severity command injection vulnerability in Fedoraproject Fedora, published on 19 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiving a specially crafted answer. This issue can only be triggered if unbound was compiled with `--enable-ipsecmod` support, and ipsecmod is enabled and used in the configuration.
Weakness: CWE-78
Which versions are affected by CVE-2019-18934?
It affects 3 products.
Linux distribution packages (8)
python3-unbound Red Hat:enterprise_linux:8::appstream | All versions | 0:1.7.3-10.el8 |
python3-unbound-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.7.3-10.el8 |
unbound Red Hat:enterprise_linux:8::appstream | All versions | 0:1.7.3-10.el8 |
unbound-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.7.3-10.el8 |
unbound-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.7.3-10.el8 |
unbound-devel Red Hat:enterprise_linux:8::appstream | All versions | 0:1.7.3-10.el8 |
unbound-libs Red Hat:enterprise_linux:8::appstream | All versions | 0:1.7.3-10.el8 |
unbound-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.7.3-10.el8 |
Products include Fedoraproject Fedora, Nlnetlabs Unbound, Opensuse Leap.
How do I fix CVE-2019-18934?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-18934 being exploited?
There is no known exploitation of CVE-2019-18934 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2019-18934, DEBIAN-CVE-2019-18934, GHSA-p35c-m7rx-rcvq, MGASA-2019-0344, RHSA-2020:1716.