CVE-2019-18934: fedoraproject fedora OS Command Injection
Vulnerability summary
CVE-2019-18934 is a high (CVSS 7.3) OS Command Injection vulnerability in fedoraproject fedora. EPSS estimates a 3.20% chance of exploitation in the next 30 days, higher than 87.9% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 5 · Related 5Timeline
- 19-11-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiving a specially crafted answer. This issue can only be triggered if unbound was compiled with `--enable-ipsecmod` support, and ipsecmod is enabled and used in the configuration.
CVSS metrics
5 scores · 4 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · DebianEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS trend
Probability
3.20%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
-0.02 pp
From 3.21% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat8 products
- python3-unbound< 0:1.7.3-10.el8
- python3-unbound-debuginfo< 0:1.7.3-10.el8
- unbound< 0:1.7.3-10.el8
- unbound-debuginfo< 0:1.7.3-10.el8
- unbound-debugsource< 0:1.7.3-10.el8
Alpine1 product
- unbound≥ 1.6.4, < 1.9.1-r4 | ≥ 1.6.4, < 1.9.5-r0 | ≥ 1.6.4, < 1.7.3-r2 | ≥ 1.6.4, < 1.8.3-r3
Debian1 product
- unbound< 1.9.6-1
Fedoraproject1 product
- fedoraEOL31
Mageia1 product
- unbound< 1.9.5-1.mga7
Nlnetlabs1 product
- unbound≥ 1.6.4, ≤ 1.9.4
Opensuse1 product
- leapEOL15.1 | 15.2
7 vendors · 14 products
References
21 links- www.openwall.com/lists/oss-security/2019/11/19/1Mailing ListX Refsource MLISTExploitThird Party Advisory
- www.nlnetlabs.nl/news/2019/Nov/19/unbound-1.9.5-released/X Refsource CONFIRMARTICLERelease NotesVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
