CVE-2019-18934

Name	CVE-2019-18934
Description	Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiving a specially crafted answer. This issue can only be triggered if unbound was compiled with `--enable-ipsecmod` support, and ipsecmod is enabled and used in the configuration.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
unbound (PTS)	stretch	1.6.0-3+deb9u2	fixed
	buster, buster (security)	1.9.0-2+deb10u2	vulnerable
	bullseye, sid	1.10.1-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency
unbound	source	jessie	(not affected)
unbound	source	stretch	(not affected)
unbound	source	(unstable)	(unfixed)	unimportant

Notes

[stretch] - unbound <not-affected> (ipsecmod module introduced later)
[jessie] - unbound <not-affected> (ipsecmod module introduced later)
Debian binary packages not built with --enable-ipsecmod
https://nlnetlabs.nl/downloads/unbound/CVE-2019-18934.txt