Package: unbound Version: 1.22.0-2+deb13u3 Severity: critical Justification: causes serious data loss X-Debbugs-Cc: [email protected]
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Dear Maintainer, I've been told by several root nameservers that version of unbound as shipped by Debian has a serious flaw that causes unbound to double the traffic to the root zone system endangering the whole stability of the DNS system (the RZ operators could still cope with this, but doubling the traffic is quite horrible). There has been large operator that upgraded to Debian Trixie and enabled serve-stale and this has caused several eyebrows to raise, and people coming to me (since they know I am DD) asking if I can help. NLNetLabs had been notified, but since this is already fixed in the upstream packages, this needs to be expeditely fixed in Debian as this can cause instability in the DNS ecosystem. Please look into this as soon as possible, or ping me if you want me to NMU unbound via security-team. I am notifying the security team as well. Thanks, Ondrej - -- System Information: Debian Release: 13.6 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable-debug'), (500, 'proposed-updates'), (500, 'stable'), (50, 'testing') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 6.12.94+deb13-amd64 (SMP w/12 CPU threads; PREEMPT) Locale: LANG=en_IE.UTF-8, LC_CTYPE=en_IE.UTF-8 (charmap=UTF-8), LANGUAGE=en_IE:en Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) Versions of packages unbound depends on: ii adduser 3.152 ii init-system-helpers 1.69~deb13u1 ii libc6 2.41-12+deb13u3 ii libevent-2.1-7t64 2.1.12-stable-10+b1 ii libhiredis1.1.0 1.2.0-6+b3 ii libnghttp2-14 1.64.0-1.1+deb13u1 ii libprotobuf-c1 1.5.1-1 ii libpython3.13 3.13.5-2+deb13u3 pn libpython3.14 <none> ii libssl3t64 3.5.6-1~deb13u2 ii libsystemd0 257.13-1~deb13u1 ii systemd [systemd-tmpfiles] 257.13-1~deb13u1 Versions of packages unbound recommends: ii dns-root-data 2025080400~deb13u1 Versions of packages unbound suggests: pn apparmor <none> ii openssl 3.5.6-1~deb13u2 -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEEw2Gx4wKVQ+vGJel9g3Kkd++uWcIFAmpfcv9fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEMz NjFCMUUzMDI5NTQzRUJDNjI1RTk3RDgzNzJBNDc3RUZBRTU5QzIACgkQg3Kkd++u WcLegxAAi1YVu97jM6GQvqzoaPSC/r80WBcsGtnOd8Tyd89t8HOImo+nIoPf5Udy TlN3bu324oh3jm3VYfkte/pWGP55UwHR47Lez4eHA32YXbV2JBZz7Xgc1MBs+WM5 G6smtsaiCpxDLXVCt4QLFmNsQGfPzDz2WNRCo/8FZjXbHtP7EMReDknRXL+JR4Gh OPcRodwYzuDGRwwWeIPI1le/jtpjYjRk8CEC59nw2WSLgmwLs8yqF6HhPmWQlSp2 PKpLh79BB3AXPl1fnraq6A5GYenm1UKamuEO/AQCaXCm3HGWAJOu6+T+tykXTHsF K2ApIBax/Ihfi728/evdNVeWH+iiNG5zntIKgDy8IBC5p8TD8KIaSM9PW5pff2Br Ii1XO3OmOv3QJz10cODqZu2+9fQ5e4fLgzDK14NYGAyoyQBe/gS75wXFLgFRLE9d UIHSPCaDsLSz+eTpSdX7M9uF6oMUx9pCImUix/OkquvM0VbRuAhoSeTS+nEjtV9A NQklG1tp48TK+GcrU5P/OP9ijAnAXj3Bp0ZpZqMzehz+9Sov+oCooxIxdh0lnqFJ kI48f0+D+VgPlmvoX8nO456LxzP1LZPZC4iNQOwI7TLX6M78FcM6bw+RMn4+Hnqi XB+/bBNk8VmLVt26dF3hCbSjzCH04yhkOHOgeZii+SjC2r73d3Y= =7rBu -----END PGP SIGNATURE-----
