git: 3fc96e7182a5 - main - security/vuxml: document unbound cache poisoning via the ECS-enabled rebirthday attack
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Fri, 18 Jul 2025 21:03:25 UTC
The branch main has been updated by tagattie:
URL: https://cgit.FreeBSD.org/ports/commit/?id=3fc96e7182a5eaa780e486c17b362f7c3d2b418c
commit 3fc96e7182a5eaa780e486c17b362f7c3d2b418c
Author: Jaap Akkerhuis <jaap@NLnetLabs.nl>
AuthorDate: 2025-07-18 20:56:48 +0000
Commit: Hiroki Tagato <tagattie@FreeBSD.org>
CommitDate: 2025-07-18 21:03:08 +0000
security/vuxml: document unbound cache poisoning via the ECS-enabled rebirthday attack
PR: 288276
Reported by: Jaap Akkerhuis <jaap@NLnetLabs.nl>
---
security/vuxml/vuln/2025.xml | 37 +++++++++++++++++++++++++++++++++++++
1 file changed, 37 insertions(+)
diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml
index f96bcf3c4234..62da17cbd37a 100644
--- a/security/vuxml/vuln/2025.xml
+++ b/security/vuxml/vuln/2025.xml
@@ -1,3 +1,40 @@
+ <vuln vid="e27ee4fc-cdc9-45a1-8242-09898cdbdc91">
+ <topic>unbound -- Cache poisoning via the ECS-enabled Rebirthday Attack</topic>
+ <affects>
+ <package>
+ <name>unbound</name>
+ <range><gt>1.6.1</gt><lt>1.23.0</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>sep@nlnetlabs.nl reports:</p>
+ <blockquote cite="https://nlnetlabs.nl/downloads/unbound/CVE-2025-5994.txt">
+ <p>A multi-vendor cache poisoning vulnerability named 'Rebirthday
+ Attack' has been discovered in caching resolvers that support
+ EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled
+ with ECS support, i.e., '--enable-subnet', AND configured
+ to send ECS information along with queries to upstream name servers,
+ i.e., at least one of the 'send-client-subnet',
+ 'client-subnet-zone' or 'client-subnet-always-forward'
+ options is used. Resolvers supporting ECS need to segregate outgoing
+ queries to accommodate for different outgoing ECS information. This
+ re-opens up resolvers to a birthday paradox attack (Rebirthday
+ Attack) that tries to match the DNS transaction ID in order to cache
+ non-ECS poisonous replies.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2025-5994</cvename>
+ <url>https://nvd.nist.gov/vuln/detail/CVE-2025-5994</url>
+ </references>
+ <dates>
+ <discovery>2025-07-16</discovery>
+ <entry>2025-07-18</entry>
+ </dates>
+ </vuln>
+
<vuln vid="aeac223e-60e1-11f0-8baa-8447094a420f">
<topic>liboqs -- Secret-dependent branching in HQC</topic>
<affects>