What is the CVSS score of CVE-2019-18934?

CVE-2019-18934 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 3.2%.

Is there a public PoC exploit available for CVE-2019-18934?

Yes, a public proof-of-concept exploit is available for CVE-2019-18934. Prioritise patching immediately. EPSS: 3.2%.

Is there a patch available for CVE-2019-18934?

Yes, a patch is available for CVE-2019-18934. Update the affected software to the latest version immediately.

Unbound CVE-2019-18934

HIGH

OS Command Injection (CWE-78)

2019-11-19 cve@mitre.org

RCE Command Injection Unbound Fedora Leap

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVE Published

Nov 19, 2019 - 18:15 nvd

HIGH 7.3

DescriptionNVD

Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiving a specially crafted answer. This issue can only be triggered if unbound was compiled with --enable-ipsecmod support, and ipsecmod is enabled and used in the configuration.

AnalysisAI

Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiving a specially crafted answer. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as OS Command Injection (CWE-78), which allows attackers to execute arbitrary operating system commands on the host. Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiving a specially crafted answer. This issue can only be triggered if unbound was compiled with --enable-ipsecmod support, and ipsecmod is enabled and used in the configuration. Affected products include: Nlnetlabs Unbound, Fedoraproject Fedora, Opensuse Leap. Version information: through 1.9.4.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Avoid passing user input to shell commands. Use language-specific APIs instead of shell execution. Apply strict input validation with allowlists.