CVE-2019-25031
unbound: configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · December 11, 2019
Updated · June 27, 2026
Description
A flaw was found in unbound. The create_unbound_ad_servers.sh bash script does not properly sanitize input data, which is retrieved using an unencrypted, unauthenticated HTTP request, before writing the configuration file allowing a man-in-the-middle attack. The highest threat from this vulnerability is to data integrity and system availability.
Statement
This issue did not affect the versions of unbound as shipped with Red Hat Enterprise Linux 7, and 8 as they did not include the vulnerable script create_unbound_ad_servers.sh.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-94 · Improper Control of Generation of Code ('Code Injection')