CVE-2019-25035

Name of the Vulnerable Software and Affected Versions Unbound versions prior to 1.9.5

Description The issue is related to an out-of-bounds write in the sldns bget token par function. However, the vendor disputes that this is a vulnerability, stating that although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited. This means that the potential impact is disputed, and there is no clear indication of exploitation in real-world incidents.

Recommendations For Unbound versions prior to 1.9.5, update to version 1.9.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the sldns bget token par function until a patch is applied. However, given the vendor's dispute, the effectiveness of this workaround is uncertain.