Skip to content
Fencer Intel
medium 6.5

CVE-2022-30698 json

Novel "ghost domain names" attack by introducing subdomain delegations

published 4y ago modified 4mo ago also EUVD-2022-52528

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a subdomain of a rogue domain name. The rogue nameserver returns delegation information for the subdomain that updates Unbound's delegation cache. This action can be repeated before expiry of the delegation information by querying Unbound for a second level subdomain which the rogue nameserver provides new delegation information. Since Unbound is a child-centric resolver, the ever-updating child delegation information can keep a rogue domain name resolvable long after revocation. From version 1.16.2 on, Unbound checks the validity of parent delegation records before using cached delegation information.

Patch / fix

  • nlnetlabs unbound 1.16.2
  • unbound Debian 14, Debian 13, Debian 12 1.16.2-1

debian advisories DEBIAN-CVE-2022-30698

  • unbound Ubuntu 18.04 LTS 1.6.7-1ubuntu2.5
  • unbound Ubuntu 20.04 LTS 1.9.4-2ubuntu1.3
  • unbound Ubuntu 22.04 LTS 1.13.1-1ubuntu5.1

ubuntu advisories UBUNTU-CVE-2022-30698

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • unbound RHEL 8 1.16.2-2.el8
  • unbound-libs RHEL 8 1.16.2-2.el8
  • python3-unbound RHEL 8 1.16.2-2.el8
  • unbound RHEL 9 1.16.2-2.el9
  • unbound-libs RHEL 9 1.16.2-2.el9
  • python3-unbound RHEL 9 1.16.2-2.el9
  • unbound RHEL 8.6 EUS 1.7.3-17.el8_6.5
  • unbound-libs RHEL 8.6 EUS 1.7.3-17.el8_6.5

red hat advisories RHSA-2024:2045RHSA-2022:7622RHSA-2022:8062

  • unbound SLE Module for Package Hub 15 SP5, SLE Module for Basesystem 15 SP5, SLE Micro 5.5 +14 more 1.20.0-150100.10.13.1
  • unbound SLE Module for Package Hub 15 SP6, SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 1.20.0-150600.23.3.1

suse advisories SUSE-SU-2024:1991-2SUSE-SU-2024:1991-1SUSE-SU-2024:1923-1

  • unbound openSUSE Tumbleweed 1.16.2-1.1

opensuse advisories openSUSE-SU-2024:12235-1

  • unbound AlmaLinux 9 1.16.2-2.el9
  • unbound-libs AlmaLinux 9 1.16.2-2.el9
  • python3-unbound AlmaLinux 9 1.16.2-2.el9
  • unbound AlmaLinux 8 1.16.2-2.el8
  • unbound-libs AlmaLinux 8 1.16.2-2.el8
  • python3-unbound AlmaLinux 8 1.16.2-2.el8

almalinux advisories ALSA-2022:8062ALSA-2022:7622

  • unbound Rocky Linux 9 1.16.2-2.el9
  • unbound Rocky Linux 8 1.16.2-2.el8

rocky linux advisories RLSA-2022:8062RLSA-2022:7622

  • unbound Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 1.16.2-r0

alpine advisories ALPINE-CVE-2022-30698

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • unbound CBL-Mariner 2.0 1.16.2-1

azure linux advisories AZL-10452

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2022-30698 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-30698 updated cvss 6.5

unbound: novel ghost domain attack that allows attackers to trigger continued resolvability of malicious domain names

  • Red Hat Enterprise Linux 6 unbound, unbound-libs, unbound-python Red Hat Enterprise Linux 7 unbound, unbound-libs, unbound-python
    affected: no fix planned “Out of support scope”
  • Red Hat CodeReady Linux Builder (v. 9) unbound-devel 1.16.2-2.el9, unbound-debuginfo 1.16.2-2.el9, unbound-debugsource 1.16.2-2.el9, unbound-libs-debuginfo 1.16.2-2.el9, python3-unbound-debuginfo 1.16.2-2.el9
    fixed: vendor fix RHSA-2022:8062
  • Red Hat Enterprise Linux AppStream (v. 8) unbound 1.16.2-2.el8, unbound-libs 1.16.2-2.el8, python3-unbound 1.16.2-2.el8
    fixed: vendor fix RHSA-2022:7622
  • Red Hat Enterprise Linux AppStream (v. 9) unbound 1.16.2-2.el9, unbound-libs 1.16.2-2.el9, python3-unbound 1.16.2-2.el9
    fixed: vendor fix RHSA-2022:8062
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) unbound 1.7.3-17.el8_6.5, unbound-libs 1.7.3-17.el8_6.5, python3-unbound 1.7.3-17.el8_6.5
    fixed: vendor fix RHSA-2024:2045

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.16% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

  • NLnet Labs Unbound

Classification

Weakness
  • CWE-613 DEPRECATED: Insufficient Session Expiration

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.