]> git.ipfire.org Git - thirdparty/unbound.git/commit
- Fix CVE-2025-11411 (possible domain hijacking attack), reported by Yuxiao Wu, branch-1.24.1 release-1.24.1
authorYorgos Thessalonikefs <yorgos@nlnetlabs.nl>
Wed, 22 Oct 2025 08:54:57 +0000 (10:54 +0200)
committerYorgos Thessalonikefs <yorgos@nlnetlabs.nl>
Wed, 22 Oct 2025 08:54:57 +0000 (10:54 +0200)
commita33f0638e1dacf2633cf2292078a674576bca852
tree1576e436b1fdbca2fa5aad60bb6d9c6a89bdf6a5
parentbbeee42e2574c87c5dd0b6d8e5c2094a21a27de0
- Fix CVE-2025-11411 (possible domain hijacking attack), reported by Yuxiao Wu,
  Yunyi Zhang, Baojun Liu and Haixin Duan from Tsinghua University.
151 files changed:
daemon/remote.c
doc/example.conf.in
doc/unbound-control.8.in
doc/unbound-control.rst
doc/unbound.conf.5.in
doc/unbound.conf.rst
iterator/iter_scrub.c
testdata/autotrust_init.rpl
testdata/autotrust_init_ds.rpl
testdata/autotrust_init_sigs.rpl
testdata/autotrust_init_zsk.rpl
testdata/black_data.rpl
testdata/black_prime.rpl
testdata/disable_edns_do.rpl
testdata/dns64_lookup.rpl
testdata/dns64_prefetch_cache.rpl
testdata/fetch_glue.rpl
testdata/fetch_glue_cname.rpl
testdata/fwd_cached.rpl
testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.conf
testdata/fwd_minimal.rpl
testdata/ipsecmod_bogus_ipseckey.crpl
testdata/ipsecmod_enabled.crpl
testdata/ipsecmod_ignore_bogus_ipseckey.crpl
testdata/ipsecmod_max_ttl.crpl
testdata/ipsecmod_strict.crpl
testdata/ipsecmod_whitelist.crpl
testdata/iter_class_any.rpl
testdata/iter_cycle_noh.rpl
testdata/iter_domain_sale.rpl
testdata/iter_domain_sale_nschange.rpl
testdata/iter_emptydp.rpl
testdata/iter_emptydp_for_glue.rpl
testdata/iter_fwdfirst.rpl
testdata/iter_fwdfirstequal.rpl
testdata/iter_fwdfirstequaltcp.rpl
testdata/iter_fwdstub.rpl
testdata/iter_fwdstubroot.rpl
testdata/iter_ghost_grandchild_delegation.rpl
testdata/iter_ghost_sub.rpl
testdata/iter_ghost_timewindow.rpl
testdata/iter_got6only.rpl
testdata/iter_hint_lame.rpl
testdata/iter_lame_noaa.rpl
testdata/iter_lame_nosoa.rpl
testdata/iter_mod.rpl
testdata/iter_ns_badip.rpl
testdata/iter_ns_spoof.rpl
testdata/iter_nxns_fallback.rpl
testdata/iter_pc_a.rpl
testdata/iter_pc_aaaa.rpl
testdata/iter_pcdiff.rpl
testdata/iter_pcdirect.rpl
testdata/iter_pcname.rpl
testdata/iter_pcnamech.rpl
testdata/iter_pcnamechrec.rpl
testdata/iter_pcnamerec.rpl
testdata/iter_pcttl.rpl
testdata/iter_prefetch.rpl
testdata/iter_prefetch_change.rpl
testdata/iter_prefetch_change2.rpl
testdata/iter_prefetch_childns.rpl
testdata/iter_prefetch_fail.rpl
testdata/iter_prefetch_ns.rpl
testdata/iter_primenoglue.rpl
testdata/iter_privaddr.rpl
testdata/iter_ranoaa_lame.rpl
testdata/iter_reclame_one.rpl
testdata/iter_reclame_two.rpl
testdata/iter_recurse.rpl
testdata/iter_resolve.rpl
testdata/iter_resolve_minimised.rpl
testdata/iter_resolve_minimised_nx.rpl
testdata/iter_resolve_minimised_refused.rpl
testdata/iter_resolve_minimised_timeout.rpl
testdata/iter_scrub_cname_an.rpl
testdata/iter_scrub_dname_insec.rpl
testdata/iter_scrub_dname_rev.rpl
testdata/iter_scrub_dname_sec.rpl
testdata/iter_scrub_promiscuous.rpl [new file with mode: 0644]
testdata/iter_scrub_rr_length.rpl
testdata/iter_soamin.rpl
testdata/iter_stub_noroot.rpl
testdata/iter_stubfirst.rpl
testdata/iter_timeout_ra_aaaa.rpl
testdata/iter_unverified_glue.rpl
testdata/rrset_rettl.rpl
testdata/rrset_untrusted.rpl
testdata/rrset_updated.rpl
testdata/rrset_use_cached.rpl
testdata/serve_expired.rpl
testdata/serve_expired_0ttl_nodata.rpl
testdata/serve_expired_0ttl_nxdomain.rpl
testdata/serve_expired_0ttl_servfail.rpl
testdata/serve_expired_cached_servfail.rpl
testdata/serve_expired_client_timeout.rpl
testdata/serve_expired_client_timeout_no_prefetch.rpl
testdata/serve_expired_client_timeout_servfail.rpl
testdata/serve_expired_client_timeout_val_insecure_delegation.rpl
testdata/serve_expired_reply_ttl.rpl
testdata/serve_expired_ttl.rpl
testdata/serve_expired_ttl_client_timeout.rpl
testdata/serve_expired_zerottl.rpl
testdata/serve_original_ttl.rpl
testdata/subnet_cached.crpl
testdata/subnet_cached_servfail.crpl
testdata/subnet_cached_size.crpl
testdata/subnet_global_prefetch.crpl
testdata/subnet_global_prefetch_always_forward.crpl
testdata/subnet_global_prefetch_expired.crpl
testdata/subnet_global_prefetch_with_client_ecs.crpl
testdata/subnet_max_source.crpl
testdata/subnet_prefetch.crpl
testdata/subnet_val_positive.crpl
testdata/subnet_val_positive_client.crpl
testdata/trust_cname_chain.rpl
testdata/ttl_max.rpl
testdata/ttl_min.rpl
testdata/val_adbit.rpl
testdata/val_adcopy.rpl
testdata/val_cnametocnamewctoposwc.rpl
testdata/val_ds_afterprime.rpl
testdata/val_faildnskey_ok.rpl
testdata/val_keyprefetch_verify.rpl
testdata/val_noadwhennodo.rpl
testdata/val_nsec3_b3_optout.rpl
testdata/val_nsec3_b3_optout_negcache.rpl
testdata/val_nsec3_b4_wild.rpl
testdata/val_nsec3_cnametocnamewctoposwc.rpl
testdata/val_positive.rpl
testdata/val_positive_wc.rpl
testdata/val_qds_badanc.rpl
testdata/val_qds_oneanc.rpl
testdata/val_qds_twoanc.rpl
testdata/val_refer_unsignadd.rpl
testdata/val_referd.rpl
testdata/val_referglue.rpl
testdata/val_rrsig.rpl
testdata/val_spurious_ns.rpl
testdata/val_stub_noroot.rpl
testdata/val_ta_algo_dnskey.rpl
testdata/val_ta_algo_dnskey_dp.rpl
testdata/val_ta_algo_missing_dp.rpl
testdata/val_twocname.rpl
testdata/val_unalgo_anchor.rpl
testdata/val_wild_pos.rpl
testdata/views.rpl
util/config_file.c
util/config_file.h
util/configlexer.lex
util/configparser.y