Skip to content
Fencer Intel
medium 6.5

CVE-2022-30699 json

Novel "ghost domain names" attack by updating almost expired delegation information

published 4y ago modified 4mo ago also EUVD-2022-52529

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

NLnet Labs Unbound, up to and including version 1.16.1, is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a rogue domain name when the cached delegation information is about to expire. The rogue nameserver delays the response so that the cached delegation information is expired. Upon receiving the delayed answer containing the delegation information, Unbound overwrites the now expired entries. This action can be repeated when the delegation information is about to expire making the rogue delegation information ever-updating. From version 1.16.2 on, Unbound stores the start time for a query and uses that to decide if the cached delegation information can be overwritten.

Patch / fix

  • nlnetlabs unbound 1.16.2
  • unbound Debian 14, Debian 13, Debian 12 1.16.2-1

debian advisories DEBIAN-CVE-2022-30699

  • unbound Ubuntu 18.04 LTS 1.6.7-1ubuntu2.5
  • unbound Ubuntu 20.04 LTS 1.9.4-2ubuntu1.3
  • unbound Ubuntu 22.04 LTS 1.13.1-1ubuntu5.1

ubuntu advisories UBUNTU-CVE-2022-30699

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • unbound RHEL 8 1.16.2-2.el8
  • unbound-libs RHEL 8 1.16.2-2.el8
  • python3-unbound RHEL 8 1.16.2-2.el8
  • unbound RHEL 9 1.16.2-2.el9
  • unbound-libs RHEL 9 1.16.2-2.el9
  • python3-unbound RHEL 9 1.16.2-2.el9
  • unbound RHEL 8.6 EUS 1.7.3-17.el8_6.5
  • unbound-libs RHEL 8.6 EUS 1.7.3-17.el8_6.5

red hat advisories RHSA-2024:2045RHSA-2022:7622RHSA-2022:8062

  • unbound SLE Module for Package Hub 15 SP5, SLE Module for Basesystem 15 SP5, SLE Micro 5.5 +14 more 1.20.0-150100.10.13.1
  • unbound SLE Module for Package Hub 15 SP6, SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 1.20.0-150600.23.3.1

suse advisories SUSE-SU-2024:1991-2SUSE-SU-2024:1991-1SUSE-SU-2024:1923-1

  • unbound AlmaLinux 9 1.16.2-2.el9
  • unbound-libs AlmaLinux 9 1.16.2-2.el9
  • python3-unbound AlmaLinux 9 1.16.2-2.el9
  • unbound AlmaLinux 8 1.16.2-2.el8
  • unbound-libs AlmaLinux 8 1.16.2-2.el8
  • python3-unbound AlmaLinux 8 1.16.2-2.el8

almalinux advisories ALSA-2022:8062ALSA-2022:7622

  • unbound Rocky Linux 9 1.16.2-2.el9
  • unbound Rocky Linux 8 1.16.2-2.el8

rocky linux advisories RLSA-2022:8062RLSA-2022:7622

  • unbound Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 1.16.2-r0

alpine advisories ALPINE-CVE-2022-30699

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • unbound CBL-Mariner 2.0 1.16.2-1

azure linux advisories AZL-10453

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2022-30699 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-30699 updated cvss 6.5

unbound: novel ghost domain attack that allows attackers to trigger continued resolvability of malicious domain names

  • Red Hat Enterprise Linux 6 unbound, unbound-libs, unbound-python Red Hat Enterprise Linux 7 unbound, unbound-libs, unbound-python
    affected: no fix planned “Out of support scope”
  • Red Hat CodeReady Linux Builder (v. 9) unbound-devel 1.16.2-2.el9, unbound-debuginfo 1.16.2-2.el9, unbound-debugsource 1.16.2-2.el9, unbound-libs-debuginfo 1.16.2-2.el9, python3-unbound-debuginfo 1.16.2-2.el9
    fixed: vendor fix RHSA-2022:8062
  • Red Hat Enterprise Linux AppStream (v. 8) unbound 1.16.2-2.el8, unbound-libs 1.16.2-2.el8, python3-unbound 1.16.2-2.el8
    fixed: vendor fix RHSA-2022:7622
  • Red Hat Enterprise Linux AppStream (v. 9) unbound 1.16.2-2.el9, unbound-libs 1.16.2-2.el9, python3-unbound 1.16.2-2.el9
    fixed: vendor fix RHSA-2022:8062
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) unbound 1.7.3-17.el8_6.5, unbound-libs 1.7.3-17.el8_6.5, python3-unbound 1.7.3-17.el8_6.5
    fixed: vendor fix RHSA-2024:2045

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.16% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

  • NLnet Labs Unbound

Classification

Weakness
  • CWE-613 DEPRECATED: Insufficient Session Expiration

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.