[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVDjdiJm91hhuNTFYz_o_hUJIs0b66dZbNOHiYHJhwp4":3,"g5a-risk:CVE-2020-28935":139},{"success":4,"data":5,"meta":137},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":39,"epssPercentile":27,"epssTimeSeries":40,"severity":41,"affectedProducts":42,"affectedProductsCount":56,"references":57,"referencesCount":79,"weaknesses":80,"weaknessesCount":89,"isActivelyExploited":90,"cisaInfo":27,"otxData":27,"relatedBlogPosts":91,"seoMetadata":92,"configurations":117,"relatedVendorCves":135,"notableEvents":136},"CVE-2020-28935","What is CVE-2020-28935?","NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound\u002FNSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound\u002FNSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound\u002FNSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound\u002FNSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound\u002FNSD is running on. It requires an attacker having access to the limited permission user Unbound\u002FNSD runs as and point through the symlink to a critical file on the system.","NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow...","2020-12-07T22:15:20.853","2023-03-29T15:15:07.057",5.5,"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":27,"CVSSMetricV2":30,"CVSSMetricV40":27},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":28,"ImpactScore":29},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":22,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":26,"ExploitCodeMaturity":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"TemporalSeverity":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":25,"ModifiedAttackVector":27,"ModifiedAttackComplexity":27,"ModifiedPrivilegesRequired":27,"ModifiedUserInteraction":27,"ModifiedScope":27,"ModifiedConfidentialityImpact":27,"ModifiedIntegrityImpact":27,"ModifiedAvailabilityImpact":27,"EnvironmentalScore":27,"EnvironmentalSeverity":27},"3.1","LOCAL","LOW","NONE","UNCHANGED","HIGH","MEDIUM",null,1.8,3.6,[31],{"Source":17,"Type":18,"CVSSData":32,"BaseSeverity":22,"ExploitabilityScore":37,"ImpactScore":38,"ACInsufInfo":27,"ObtainAllPrivilege":27,"ObtainUserPrivilege":27,"ObtainOtherPrivilege":27,"UserInteractionRequired":27},{"Version":33,"VectorString":34,"AccessVector":21,"AccessComplexity":22,"Authentication":23,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":35,"BaseScore":36,"BaseSeverity":27,"Exploitability":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"CollateralDamagePotential":27,"TargetDistribution":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":27,"EnvironmentalScore":27},"2.0","AV:L\u002FAC:L\u002FAu:N\u002FC:N\u002FI:N\u002FA:P","PARTIAL",2.1,3.9,2.9,0.00494,[39,39,39,39,39,39,39],"Medium",[43,48,51],{"vendor":44,"product":45,"version":46,"criteria":47,"vulnerable":4},"nlnetlabs","name_server_daemon","*","cpe:2.3:a:nlnetlabs:name_server_daemon:*:*:*:*:*:*:*:*",{"vendor":44,"product":49,"version":46,"criteria":50,"vulnerable":4},"unbound","cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*",{"vendor":52,"product":53,"version":54,"criteria":55,"vulnerable":4},"debian","debian_linux","9.0","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",3,[58,64,67,71,76],{"url":59,"source":60,"tags":61},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2021\u002F02\u002Fmsg00017.html","Debian",[62,63],"Mailing List","Third Party Advisory",{"url":65,"source":60,"tags":66},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2023\u002F03\u002Fmsg00024.html",[],{"url":68,"source":69,"tags":70},"https:\u002F\u002Fsecurity.gentoo.org\u002Fglsa\u002F202101-38","Gentoo",[63],{"url":72,"source":73,"tags":74},"https:\u002F\u002Fwww.nlnetlabs.nl\u002Fdownloads\u002Fnsd\u002FCVE-2020-28935.txt","Nlnetlabs",[75],"Vendor Advisory",{"url":77,"source":73,"tags":78},"https:\u002F\u002Fwww.nlnetlabs.nl\u002Fdownloads\u002Funbound\u002FCVE-2020-28935.txt",[75],5,[81],{"id":82,"name":83,"description":84,"extendedDescription":85,"status":86,"abstraction":87,"structure":88},"CWE-59","Improper Link Resolution Before File Access ('Link Following')","The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.","","Draft","Base","Simple",1,false,[],{"title":93,"metaDescription":94,"keywords":95,"canonicalUrl":96,"structuredData":97},"What is CVE-2020-28935? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2020-28935, a medium severity cyber security vulnerability from 2020. NLnet Labs Unbound, up to and including version 1.12.0, a...","CVE-2020-28935, CVE-2020-28935 vulnerability, CVE-2020-28935 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2020, CVSS score, exploit, patch, remediation, nlnetlabs security, debian security, name_server_daemon vulnerability, unbound vulnerability, debian_linux vulnerability","\u002Fwhat-is\u002Fcve-2020-28935",{"@context":98,"@type":99,"headline":93,"description":94,"datePublished":10,"dateModified":11,"author":100,"publisher":104,"about":108,"mainEntityOfPage":112,"articleSection":115,"keywords":116},"https:\u002F\u002Fschema.org","TechArticle",{"@type":101,"name":102,"url":103},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":101,"name":102,"url":103,"logo":105},{"@type":106,"url":107},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":109,"name":6,"description":110,"additionalType":111},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":113,"@id":114},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2020-28935","Cybersecurity","CVE-2020-28935, CVE-2020-28935 vulnerability, CVE-2020-28935 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[118,129],{"Operator":27,"Negate":27,"Nodes":119},[120],{"Operator":121,"Negate":27,"CPEMatch":122},"OR",[123,126],{"Vulnerable":4,"Criteria":47,"MatchCriteriaID":124,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":125,"VersionEndIncluding":27},"2999AD3A-4E86-4E7F-94DC-7972AF046056","4.3.4",{"Vulnerable":4,"Criteria":50,"MatchCriteriaID":127,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":128,"VersionEndIncluding":27},"B5033957-63F8-4F49-A451-96BEF9644520","1.13.0",{"Operator":27,"Negate":27,"Nodes":130},[131],{"Operator":121,"Negate":27,"CPEMatch":132},[133],{"Vulnerable":4,"Criteria":55,"MatchCriteriaID":134,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":27},"DEECE5FC-CACF-4496-A3E7-164736409252",[],[],{"lastModified":11,"cacheTime":138,"version":33},1792358923048,{"score":140,"band":141,"action":142,"scoredAt":143},19,"Info","Track","2026-10-16T06:49:57.991908+00:00"]