CVE-2020-10772: nlnetlabs unbound
Vulnerability summary
CVE-2020-10772 is a high (CVSS 7.5) vulnerability in nlnetlabs unbound. EPSS estimates a 1.35% chance of exploitation in the next 30 days, higher than 71% of scored vulnerabilities.
Timeline
- 27-11-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared to versions of Unbound that shipped before the mentioned erratum. This issue is about the incomplete fix for CVE-2020-12662, and it does not affect upstream versions of Unbound.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.35%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
0.00 pp
From 1.35% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-406Insufficient Control of Network Message Volume (Network Amplification)The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.
- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
Affected systems
Redhat5 products
- unbound< 0:1.6.6-5.el7_8
- unbound-debuginfo< 0:1.6.6-5.el7_8
- unbound-devel< 0:1.6.6-5.el7_8
- unbound-libs< 0:1.6.6-5.el7_8
- unbound-python< 0:1.6.6-5.el7_8
Nlnetlabs1 product
- unbound1.6.6-5
2 vendors · 6 products
