https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30698

    NVD
    Go to for:
    CVSS Scores
    CPE Info

        
    CVE ListV
    CVE List Search Search Tips CVE Request Web Form Web Form Help
    PGP Key CVE List Documents & Guidance Terms of Use
          
    CNAsV
    CVE Numbering Authorities (CNAs) Participating CNAs CNA
    Documents, Policies & Guidance CNA Rules, Version 3.0 New CNA
    Onboarding Slides & Videos How to Become a CNA
           
    WGsV
CVE CVE Working Groups Automation (AWG) CNA Coordination (CNACWG)
    Outreach and Communications (OCWG) CVE Quality (QWG) Strategic
    Planning (SPWG) Transition (TWG)
           
    BoardV
    CVE Board Members Email Archives Meeting Archives Board Charter
           
    AboutV
    About CVE Professional Code of Conduct CVE & NVD Relationship
    History Sponsor Documentation & Guidance FAQs Terminology
         
    News & BlogV
    Latest CVE News Blog Podcast Calendar Archive Follow CVE Free CVE
    Newsletter CVEnew Twitter Feed Twitter CVEannounce Twitter Feed 
    Twitter CVE on Medium Medium CVE on LinkedIn LinkedIn CVEProject
    on GitHub GitHub CVE on YouTube YouTube

     
       
Search CVE List
       
Downloads
       
Data Feeds
       
Update a CVE Record
       
Request CVE IDs
       
TOTAL CVE Records: 182538

NOTICE: Transition to the all-new CVE website at WWW.CVE.ORG is
underway and will last up to one year. (details)

NOTICE: Changes coming to CVE Record Format JSON and CVE List Content
Downloads in 2022.


Home > CVE > CVE-2022-30698  
                               CVE-ID
CVE-2022-30698 Learn more at National Vulnerability Database (NVD)
               * CVSS Severity Rating * Fix Information * Vulnerable
               Software Versions * SCAP Mappings * CPE Information
                            Description
NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable
to a novel type of the "ghost domain names" attack. The
vulnerability works by targeting an Unbound instance. Unbound is
queried for a subdomain of a rogue domain name. The rogue nameserver
returns delegation information for the subdomain that updates
Unbound's delegation cache. This action can be repeated before
expiry of the delegation information by querying Unbound for a
second level subdomain which the rogue nameserver provides new
delegation information. Since Unbound is a child-centric resolver,
the ever-updating child delegation information can keep a rogue
domain name resolvable long after revocation. From version 1.16.2
on, Unbound checks the validity of parent delegation records before
using cached delegation information.
                             References
Note: References are provided for the convenience of the reader to
help distinguish between vulnerabilities. The list is not intended
to be complete.
  * CONFIRM:https://www.nlnetlabs.nl/downloads/unbound/
    CVE-2022-30698_CVE-2022-30699.txt
  * URL:https://www.nlnetlabs.nl/downloads/unbound/
    CVE-2022-30698_CVE-2022-30699.txt
  * FEDORA:FEDORA-2022-f89beb0640
  * URL:https://lists.fedoraproject.org/archives/list/
    package-announce@lists.fedoraproject.org/message/
    5L3ZFWZZFPBIL654BG75RWXUMPFQJ5EC/

                           Assigning CNA
NLnet Labs
                        Date Record Created
               Disclaimer: The record creation date may reflect when
               the CVE ID was allocated or reserved, and does not
20220513       necessarily indicate when this vulnerability was
               discovered, shared with the affected vendor, publicly
               disclosed, or updated in CVE.
                           Phase (Legacy)
Assigned (20220513)
                           Votes (Legacy)
                         Comments (Legacy)

                         Proposed (Legacy)
N/A
This is a record on the CVE List, which provides common identifiers
for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords:   [Submit]
You can also search by reference using the CVE Reference Maps.
For More Information:  CVE Request Web Form (select "Other" from
dropdown)
Back to top

Site Map | Terms of Use | Privacy Policy | Contact Us | Follow CVE 
Twitter LinkedIn GitHub YouTube Medium       #

Use of the CVE(r) List and the associated references from this website
are subject to the terms of use. CVE is sponsored by the U.S.
Department of Homeland Security (DHS) Cybersecurity and
Infrastructure Security Agency (CISA). Copyright (c) 1999-2022, The
MITRE Corporation. CVE and the CVE logo are registered trademarks of
The MITRE Corporation.