Skip to content
Fencer Intel
medium 5.5

CVE-2020-28935 json

Local symlink attack in Unbound and NSD

published 5y ago modified 4mo ago also EUVD-2020-21323

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits
0
none known

Summary

NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.

Patch / fix

  • nlnetlabs name_server_daemon 4.3.4
  • nlnetlabs unbound 1.13.0
  • nsd Debian 14, Debian 13, Debian 12 4.3.4-1
  • unbound Debian 14, Debian 13, Debian 12 1.13.0-1

debian advisories DEBIAN-CVE-2020-28935

  • unbound Ubuntu 18.04 LTS 1.6.7-1ubuntu2.4
  • unbound Ubuntu 20.04 LTS 1.9.4-2ubuntu1.2

ubuntu advisories UBUNTU-CVE-2020-28935

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • unbound RHEL 8 1.7.3-15.el8
  • unbound-libs RHEL 8 1.7.3-15.el8
  • python3-unbound RHEL 8 1.7.3-15.el8
  • unbound RHEL 8.2 EUS 1.7.3-12.el8_2
  • unbound-libs RHEL 8.2 EUS 1.7.3-12.el8_2
  • python3-unbound RHEL 8.2 EUS 1.7.3-12.el8_2

red hat advisories RHSA-2022:0632RHSA-2021:1853

  • unbound SLES 15 SP2-BCL, SLES 15 SP1-BCL, SLE Real Time 15 SP2 +14 more 1.6.8-10.6.1
  • unbound SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 1.6.8-3.9.1

suse advisories SUSE-SU-2022:0176-2SUSE-SU-2022:0301-1SUSE-SU-2022:0176-1

  • sslh openSUSE Tumbleweed 2.2.3-1.1
  • unbound openSUSE Tumbleweed 1.13.2-1.2
  • nsd openSUSE Tumbleweed 4.3.7-1.2
  • unbound openSUSE Leap 15.3 1.6.8-10.6.1
  • nsd Package Hub 15 SP2, Package Hub 15 SP1, Package Hub 12 +2 more 4.3.4-bp152.2.3.1

opensuse advisories openSUSE-SU-2025:15069-1openSUSE-SU-2024:11005-1openSUSE-SU-2024:11100-1openSUSE-SU-2022:0176-1openSUSE-SU-2020:2222-1

  • unbound Rocky Linux 8 1.7.3-15.el8

rocky linux advisories RLSA-2021:1853

  • nsd Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 4.3.4-r0

alpine advisories ALPINE-CVE-2020-28935

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • unbound CBL-Mariner 2.0 1.10.0-5

azure linux advisories AZL-6931

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • unbound Arch Linux 1.13.0-1
  • nsd Arch Linux 4.3.4-1

arch linux advisories AVG-1326AVG-1327

Is CVE-2020-28935 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-28935 updated cvss 4.4

unbound: symbolic link traversal when writing PID file

  • Red Hat Enterprise Linux 6 unbound, unbound-libs, unbound-python Red Hat Enterprise Linux 7 unbound, unbound-libs, unbound-python
    affected: workaround, no fix planned “If SELinux is enabled in Enforcing mode (the default value in Red Hat Enterprise Linux 8), this kind of attack is prevented as unbound would be blocked from accessing the symbolic link file.”
  • Red Hat Enterprise Linux AppStream (v. 8) unbound 1.7.3-15.el8, unbound-libs 1.7.3-15.el8, python3-unbound 1.7.3-15.el8
    fixed: vendor fix “If SELinux is enabled in Enforcing mode (the default value in Red Hat Enterprise Linux 8), this kind of attack is prevented as unbound would be blocked from accessing the symbolic link file.” RHSA-2021:1853
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) unbound 1.7.3-12.el8_2, unbound-libs 1.7.3-12.el8_2, python3-unbound 1.7.3-12.el8_2
    fixed: vendor fix “If SELinux is enabled in Enforcing mode (the default value in Red Hat Enterprise Linux 8), this kind of attack is prevented as unbound would be blocked from accessing the symbolic link file.” RHSA-2022:0632
  • Red Hat Enterprise Linux 9 unbound, unbound-libs, unbound-dracut, python3-unbound
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • NLnet Labs Unbound
  • NLnet Labs NSD

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.