一、漏洞信息

漏洞编号：[CVE-2024-1488](https://nvd.nist.gov/vuln/detail/CVE-2024-1488)

漏洞归属组件：[unbound](https://gitee.com/src-openeuler/unbound)

漏洞归属的版本：1.10.1,1.11.0,1.13.2,1.17.0,1.17.1

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

unbound allows by default not only members of unbound group to change any unbound runtime configuration, but any process able to connect over localhost to port 8953, can change configuration of unbound.service. Unbound is somehow powerful in what can be changed runtime. Different forwarders can be set, allowing unprivileged process to track all queries forwarder by local resolver and of course it can be configured in a way it stops resolving completely.Introduced by commit https://src.fedoraproject.org/rpms/unbound/c/39b47dbaf1ebe59e71a0e4269a6bb62d3126ba7dhttps://src.fedoraproject.org/rpms/unbound/c/2cd0b94125f7cd88cdb777a8f546f3480bbd750a

漏洞公开时间：

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-1488

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/39b47dbaf1ebe59e71a0e4269a6bb62d3126ba7d | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/2cd0b94125f7cd88cdb777a8f546f3480bbd750a | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(1.17.1):

2.openEuler-20.03-LTS-SP1(1.11.0):

3.openEuler-20.03-LTS-SP4(1.11.0):

4.openEuler-22.03-LTS(1.13.2):

5.openEuler-22.03-LTS-Next(1.13.2):

6.openEuler-22.03-LTS-SP1(1.13.2):

7.openEuler-22.03-LTS-SP2(1.13.2):

8.openEuler-22.03-LTS-SP3(1.13.2):

修复是否涉及abi变化(是/否)：

1.master(1.17.1):

2.openEuler-20.03-LTS-SP1(1.11.0):

3.openEuler-20.03-LTS-SP4(1.11.0):

4.openEuler-22.03-LTS(1.13.2):

5.openEuler-22.03-LTS-Next(1.13.2):

6.openEuler-22.03-LTS-SP1(1.13.2):

7.openEuler-22.03-LTS-SP2(1.13.2):

8.openEuler-22.03-LTS-SP3(1.13.2):

一、漏洞信息

漏洞编号：[CVE-2024-1488](https://nvd.nist.gov/vuln/detail/CVE-2024-1488)

漏洞归属组件：[unbound](https://gitee.com/src-openeuler/unbound)

漏洞归属的版本：1.10.1,1.11.0,1.13.2,1.17.0,1.17.1

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

unbound allows by default not only members of unbound group to change any unbound runtime configuration, but any process able to connect over localhost to port 8953, can change configuration of unbound.service. Unbound is somehow powerful in what can be changed runtime. Different forwarders can be set, allowing unprivileged process to track all queries forwarder by local resolver and of course it can be configured in a way it stops resolving completely.Introduced by commit https://src.fedoraproject.org/rpms/unbound/c/39b47dbaf1ebe59e71a0e4269a6bb62d3126ba7dhttps://src.fedoraproject.org/rpms/unbound/c/2cd0b94125f7cd88cdb777a8f546f3480bbd750a

漏洞公开时间：

漏洞创建时间：2024-02-14 21:27:56

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-1488

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/39b47dbaf1ebe59e71a0e4269a6bb62d3126ba7d | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/2cd0b94125f7cd88cdb777a8f546f3480bbd750a | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(1.17.1):

2.openEuler-20.03-LTS-SP1(1.11.0):

3.openEuler-20.03-LTS-SP4(1.11.0):

4.openEuler-22.03-LTS(1.13.2):

5.openEuler-22.03-LTS-Next(1.13.2):

6.openEuler-22.03-LTS-SP1(1.13.2):

7.openEuler-22.03-LTS-SP2(1.13.2):

8.openEuler-22.03-LTS-SP3(1.13.2):

修复是否涉及abi变化(是/否)：

1.master(1.17.1):

2.openEuler-20.03-LTS-SP1(1.11.0):

3.openEuler-20.03-LTS-SP4(1.11.0):

4.openEuler-22.03-LTS(1.13.2):

5.openEuler-22.03-LTS-Next(1.13.2):

6.openEuler-22.03-LTS-SP1(1.13.2):

7.openEuler-22.03-LTS-SP2(1.13.2):

8.openEuler-22.03-LTS-SP3(1.13.2):

一、漏洞信息

漏洞编号：[CVE-2024-1488](https://nvd.nist.gov/vuln/detail/CVE-2024-1488)

漏洞归属组件：[unbound](https://gitee.com/src-openeuler/unbound)

漏洞归属的版本：1.10.1,1.11.0,1.13.2,1.17.0,1.17.1

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

漏洞公开时间：

漏洞创建时间：2024-02-14 21:27:56

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-1488

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/39b47dbaf1ebe59e71a0e4269a6bb62d3126ba7d | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/2cd0b94125f7cd88cdb777a8f546f3480bbd750a | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(1.17.1):

2.openEuler-20.03-LTS-SP1(1.11.0):

3.openEuler-20.03-LTS-SP4(1.11.0):

4.openEuler-22.03-LTS(1.13.2):

5.openEuler-22.03-LTS-Next(1.13.2):

6.openEuler-22.03-LTS-SP1(1.13.2):

7.openEuler-22.03-LTS-SP2(1.13.2):

8.openEuler-22.03-LTS-SP3(1.13.2):

修复是否涉及abi变化(是/否)：

1.master(1.17.1):

2.openEuler-20.03-LTS-SP1(1.11.0):

3.openEuler-20.03-LTS-SP4(1.11.0):

4.openEuler-22.03-LTS(1.13.2):

5.openEuler-22.03-LTS-Next(1.13.2):

6.openEuler-22.03-LTS-SP1(1.13.2):

7.openEuler-22.03-LTS-SP2(1.13.2):

8.openEuler-22.03-LTS-SP3(1.13.2):

一、漏洞信息

漏洞编号：[CVE-2024-1488](https://nvd.nist.gov/vuln/detail/CVE-2024-1488)

漏洞归属组件：[unbound](https://gitee.com/src-openeuler/unbound)

漏洞归属的版本：1.10.1,1.11.0,1.13.2,1.17.0,1.17.1

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

漏洞公开时间：

漏洞创建时间：2024-02-14 21:27:56

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-1488

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/39b47dbaf1ebe59e71a0e4269a6bb62d3126ba7d | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/2cd0b94125f7cd88cdb777a8f546f3480bbd750a | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

一、漏洞信息

漏洞编号：[CVE-2024-1488](https://nvd.nist.gov/vuln/detail/CVE-2024-1488)

漏洞归属组件：[unbound](https://gitee.com/src-openeuler/unbound)

漏洞归属的版本：1.10.1,1.11.0,1.13.2,1.17.0,1.17.1

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

漏洞公开时间：

漏洞创建时间：2024-02-14 21:27:56

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-1488

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/39b47dbaf1ebe59e71a0e4269a6bb62d3126ba7d | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/2cd0b94125f7cd88cdb777a8f546f3480bbd750a | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-1488 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(1.17.1):

2.openEuler-20.03-LTS-SP1(1.11.0):

3.openEuler-20.03-LTS-SP4(1.11.0):

4.openEuler-22.03-LTS(1.13.2):

5.openEuler-22.03-LTS-Next(1.13.2):

6.openEuler-22.03-LTS-SP1(1.13.2):

7.openEuler-22.03-LTS-SP2(1.13.2):

8.openEuler-22.03-LTS-SP3(1.13.2):

修复是否涉及abi变化(是/否)：

1.master(1.17.1):

2.openEuler-20.03-LTS-SP1(1.11.0):

3.openEuler-20.03-LTS-SP4(1.11.0):

4.openEuler-22.03-LTS(1.13.2):

5.openEuler-22.03-LTS-Next(1.13.2):

6.openEuler-22.03-LTS-SP1(1.13.2):

7.openEuler-22.03-LTS-SP2(1.13.2):

8.openEuler-22.03-LTS-SP3(1.13.2):

一、漏洞信息

漏洞编号：[CVE-2024-1488](https://nvd.nist.gov/vuln/detail/CVE-2024-1488)

漏洞归属组件：[unbound](https://gitee.com/src-openeuler/unbound)

漏洞归属的版本：1.10.1,1.11.0,1.13.2,1.17.0,1.17.1

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.

漏洞公开时间：

漏洞创建时间：2024-02-14 21:27:56

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-1488

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

一、漏洞信息

漏洞编号：[CVE-2024-1488](https://nvd.nist.gov/vuln/detail/CVE-2024-1488)

漏洞归属组件：[unbound](https://gitee.com/src-openeuler/unbound)

漏洞归属的版本：1.10.1,1.11.0,1.13.2,1.17.0,1.17.1

漏洞简述：

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.

漏洞创建时间：2024-02-14 21:27:56

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-1488

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

一、漏洞信息

漏洞编号：[CVE-2024-1488](https://nvd.nist.gov/vuln/detail/CVE-2024-1488)

漏洞归属组件：[unbound](https://gitee.com/src-openeuler/unbound)

漏洞归属的版本：1.10.1,1.11.0,1.13.2,1.17.0,1.17.1

CVSS V3.0分值：

BaseScore：8.0 High

Vector：CVSS：3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

漏洞简述：

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.

漏洞公开时间：2024-02-15 13:15:10

漏洞创建时间：2024-02-14 21:27:56

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-1488

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| secalert.redhat.com | https://access.redhat.com/security/cve/CVE-2024-1488 | |

| secalert.redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 | |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://access.redhat.com/security/cve/CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/39b47dbaf1ebe59e71a0e4269a6bb62d3126ba7d | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/2cd0b94125f7cd88cdb777a8f546f3480bbd750a | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-1488 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

一、漏洞信息

漏洞编号：[CVE-2024-1488](https://nvd.nist.gov/vuln/detail/CVE-2024-1488)

漏洞归属组件：[unbound](https://gitee.com/src-openeuler/unbound)

漏洞归属的版本：1.10.1,1.11.0,1.13.2,1.17.0,1.17.1

CVSS V3.0分值：

BaseScore：8.0 High

Vector：CVSS：3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

漏洞简述：

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.

漏洞公开时间：2024-02-15 13:15:10

漏洞创建时间：2024-02-14 21:27:56

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-1488

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| secalert.redhat.com | https://access.redhat.com/security/cve/CVE-2024-1488 | |

| secalert.redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 | |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://access.redhat.com/security/cve/CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/39b47dbaf1ebe59e71a0e4269a6bb62d3126ba7d | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/2cd0b94125f7cd88cdb777a8f546f3480bbd750a | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-1488 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-1488 | https://explore.alas.aws.amazon.com/CVE-2024-1488.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1488 | https://explore.alas.aws.amazon.com/CVE-2024-1488.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

8.0

Vector：CVSS：3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

受影响版本排查(受影响/不受影响)：

修复是否涉及abi变化(是/否)：

一、漏洞信息

漏洞编号：[CVE-2024-1488](https://nvd.nist.gov/vuln/detail/CVE-2024-1488)

漏洞归属组件：[unbound](https://gitee.com/src-openeuler/unbound)

漏洞归属的版本：1.10.1,1.11.0,1.13.2,1.17.0,1.17.1

CVSS V3.0分值：

BaseScore：8.0 High

Vector：CVSS：3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

漏洞简述：

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.

漏洞公开时间：2024-02-15 13:15:10

漏洞创建时间：2024-02-14 21:27:56

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-1488

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| secalert.redhat.com | https://access.redhat.com/security/cve/CVE-2024-1488 | |

| secalert.redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 | |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://access.redhat.com/security/cve/CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/39b47dbaf1ebe59e71a0e4269a6bb62d3126ba7d | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/2cd0b94125f7cd88cdb777a8f546f3480bbd750a | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-1488 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-1488 | https://explore.alas.aws.amazon.com/CVE-2024-1488.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1488 | https://explore.alas.aws.amazon.com/CVE-2024-1488.html |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

8.0

Vector：CVSS：3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

受影响版本排查(受影响/不受影响)：

1.master(1.17.1):受影响

2.openEuler-20.03-LTS-SP1(1.11.0):受影响

3.openEuler-20.03-LTS-SP4(1.11.0):受影响

4.openEuler-22.03-LTS(1.13.2):受影响

5.openEuler-22.03-LTS-Next(1.13.2):受影响

6.openEuler-22.03-LTS-SP1(1.13.2):受影响

7.openEuler-22.03-LTS-SP2(1.13.2):受影响

8.openEuler-22.03-LTS-SP3(1.13.2):受影响

修复是否涉及abi变化(是/否)：

1.master(1.17.1):是

2.openEuler-20.03-LTS-SP1(1.11.0):是

3.openEuler-20.03-LTS-SP4(1.11.0):是

4.openEuler-22.03-LTS(1.13.2):是

5.openEuler-22.03-LTS-Next(1.13.2):是

6.openEuler-22.03-LTS-SP1(1.13.2):是

7.openEuler-22.03-LTS-SP2(1.13.2):是

8.openEuler-22.03-LTS-SP3(1.13.2):是

一、漏洞信息

漏洞编号：[CVE-2024-1488](https://nvd.nist.gov/vuln/detail/CVE-2024-1488)

漏洞归属组件：[unbound](https://gitee.com/src-openeuler/unbound)

漏洞归属的版本：1.10.1,1.11.0,1.13.2,1.17.0,1.17.1

CVSS V3.0分值：

BaseScore：8.0 High

Vector：CVSS：3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

漏洞简述：

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.

漏洞公开时间：2024-02-15 13:15:10

漏洞创建时间：2024-02-14 21:27:56

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-1488

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| secalert.redhat.com | https://access.redhat.com/security/cve/CVE-2024-1488 | |

| secalert.redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 | |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://access.redhat.com/security/cve/CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/39b47dbaf1ebe59e71a0e4269a6bb62d3126ba7d | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/2cd0b94125f7cd88cdb777a8f546f3480bbd750a | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-1488 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-1488 | https://explore.alas.aws.amazon.com/CVE-2024-1488.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1488 | https://explore.alas.aws.amazon.com/CVE-2024-1488.html |

一、漏洞信息

漏洞编号：[CVE-2024-1488](https://nvd.nist.gov/vuln/detail/CVE-2024-1488)

漏洞归属组件：[unbound](https://gitee.com/src-openeuler/unbound)

漏洞归属的版本：1.10.1,1.11.0,1.13.2,1.17.0,1.17.1

CVSS V3.0分值：

BaseScore：8.0 High

Vector：CVSS：3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

漏洞简述：

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.

漏洞公开时间：2024-02-15 13:15:10

漏洞创建时间：2024-02-14 21:27:56

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-1488

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| secalert.redhat.com | https://access.redhat.com/security/cve/CVE-2024-1488 | |

| secalert.redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 | |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://access.redhat.com/security/cve/CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/39b47dbaf1ebe59e71a0e4269a6bb62d3126ba7d | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/2cd0b94125f7cd88cdb777a8f546f3480bbd750a | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-1488 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-1488 | https://explore.alas.aws.amazon.com/CVE-2024-1488.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1488 | https://explore.alas.aws.amazon.com/CVE-2024-1488.html |

| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 | https://security.snyk.io/vuln/SNYK-UNMANAGED-UNBOUND-6252553 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

8.0

Vector：CVSS：3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

受影响版本排查(受影响/不受影响)：

1.master(1.17.1):受影响

2.openEuler-20.03-LTS-SP1(1.11.0):受影响

3.openEuler-20.03-LTS-SP4(1.11.0):受影响

4.openEuler-22.03-LTS(1.13.2):受影响

5.openEuler-22.03-LTS-Next(1.13.2):受影响

6.openEuler-22.03-LTS-SP1(1.13.2):受影响

7.openEuler-22.03-LTS-SP2(1.13.2):受影响

8.openEuler-22.03-LTS-SP3(1.13.2):受影响

修复是否涉及abi变化(是/否)：

1.master(1.17.1):是

2.openEuler-20.03-LTS-SP1(1.11.0):是

3.openEuler-20.03-LTS-SP4(1.11.0):是

4.openEuler-22.03-LTS(1.13.2):是

5.openEuler-22.03-LTS-Next(1.13.2):是

6.openEuler-22.03-LTS-SP1(1.13.2):是

7.openEuler-22.03-LTS-SP2(1.13.2):是

8.openEuler-22.03-LTS-SP3(1.13.2):是

一、漏洞信息

漏洞编号：[CVE-2024-1488](https://nvd.nist.gov/vuln/detail/CVE-2024-1488)

漏洞归属组件：[unbound](https://gitee.com/src-openeuler/unbound)

漏洞归属的版本：1.10.1,1.11.0,1.13.2,1.17.0,1.17.1

CVSS V3.0分值：

BaseScore：8.0 High

Vector：CVSS：3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

漏洞简述：

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.

漏洞公开时间：2024-02-15 13:15:10

漏洞创建时间：2024-02-14 21:27:56

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-1488

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| secalert.redhat.com | https://access.redhat.com/security/cve/CVE-2024-1488 | |

| secalert.redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 | |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://access.redhat.com/security/cve/CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/39b47dbaf1ebe59e71a0e4269a6bb62d3126ba7d | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/2cd0b94125f7cd88cdb777a8f546f3480bbd750a | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-1488 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-1488 | https://explore.alas.aws.amazon.com/CVE-2024-1488.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1488 | https://explore.alas.aws.amazon.com/CVE-2024-1488.html |

| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 | https://security.snyk.io/vuln/SNYK-UNMANAGED-UNBOUND-6252553 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

8.0

Vector：CVSS：3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

受影响版本排查(受影响/不受影响)：

1.master(1.17.1):受影响

2.openEuler-20.03-LTS-SP1(1.11.0):受影响

3.openEuler-20.03-LTS-SP4(1.11.0):受影响

4.openEuler-22.03-LTS(1.13.2):受影响

5.openEuler-22.03-LTS-Next(1.13.2):受影响

6.openEuler-22.03-LTS-SP1(1.13.2):受影响

7.openEuler-22.03-LTS-SP2(1.13.2):受影响

8.openEuler-22.03-LTS-SP3(1.13.2):受影响

修复是否涉及abi变化(是/否)：

1.master(1.17.1):是

2.openEuler-20.03-LTS-SP1(1.11.0):是

3.openEuler-20.03-LTS-SP4(1.11.0):是

4.openEuler-22.03-LTS(1.13.2):是

5.openEuler-22.03-LTS-Next(1.13.2):是

6.openEuler-22.03-LTS-SP1(1.13.2):是

7.openEuler-22.03-LTS-SP2(1.13.2):是

8.openEuler-22.03-LTS-SP3(1.13.2):是

一、漏洞信息

漏洞编号：[CVE-2024-1488](https://nvd.nist.gov/vuln/detail/CVE-2024-1488)

漏洞归属组件：[unbound](https://gitee.com/src-openeuler/unbound)

漏洞归属的版本：1.10.1,1.11.0,1.13.2,1.17.0,1.17.1

CVSS V3.0分值：

BaseScore：8.0 High

Vector：CVSS：3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

漏洞简述：

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.

漏洞公开时间：2024-02-15 13:15:10

漏洞创建时间：2024-02-14 21:27:56

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-1488

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| secalert.redhat.com | https://access.redhat.com/security/cve/CVE-2024-1488 | |

| secalert.redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 | |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| suse_bugzilla | https://access.redhat.com/security/cve/CVE-2024-1488 | https://bugzilla.suse.com/show_bug.cgi?id=1219963 |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/39b47dbaf1ebe59e71a0e4269a6bb62d3126ba7d | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| redhat_bugzilla | https://src.fedoraproject.org/rpms/unbound/c/2cd0b94125f7cd88cdb777a8f546f3480bbd750a | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-1488 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-1488 | https://explore.alas.aws.amazon.com/CVE-2024-1488.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1488 | https://explore.alas.aws.amazon.com/CVE-2024-1488.html |

| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2264183 | https://security.snyk.io/vuln/SNYK-UNMANAGED-UNBOUND-6252553 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

8.0

Vector：CVSS：3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

受影响版本排查(受影响/不受影响)：

1.master(1.17.1):受影响

2.openEuler-20.03-LTS-SP1(1.11.0):受影响

3.openEuler-20.03-LTS-SP4(1.11.0):受影响

4.openEuler-22.03-LTS(1.13.2):受影响

5.openEuler-22.03-LTS-Next(1.13.2):受影响

6.openEuler-22.03-LTS-SP1(1.13.2):受影响

7.openEuler-22.03-LTS-SP2(1.13.2):受影响

8.openEuler-22.03-LTS-SP3(1.13.2):受影响

修复是否涉及abi变化(是/否)：

1.master(1.17.1):是

2.openEuler-20.03-LTS-SP1(1.11.0):是

3.openEuler-20.03-LTS-SP4(1.11.0):是

4.openEuler-22.03-LTS(1.13.2):是

5.openEuler-22.03-LTS-Next(1.13.2):是

6.openEuler-22.03-LTS-SP1(1.13.2):是

7.openEuler-22.03-LTS-SP2(1.13.2):是

8.openEuler-22.03-LTS-SP3(1.13.2):是