CVE-2019-25041: 
NixOS vulnerability analysis and mitigation

CVE-2019-25041 affects Unbound DNS resolver versions before 1.9.5, allowing an assertion failure via a compressed name in dname_pkt_copy. The vulnerability was discovered during a security audit conducted by X41 D-Sec in December 2019. Notably, the vendor disputes this as a vulnerability, stating that although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited (Ubuntu Security, OSTIF Audit).

The vulnerability is related to an assertion failure that can be triggered in the dname_pkt_copy function when processing compressed names. It has been assigned a CVSS v3.1 score of 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network accessibility with no required privileges or user interaction (NetApp Security).

While the vendor disputes the exploitability, the vulnerability could potentially lead to a denial of service condition through assertion failure. However, the impact is limited as the vendor maintains that a running Unbound installation cannot be exploited either remotely or locally (Debian Security).

The vulnerability was fixed in commit 2d444a5037acff6024630b88092d9188f2f5d8fe. The vendor disputes the practical exploitability of this vulnerability, stating that although the code may be vulnerable, a running Unbound installation cannot be exploited either remotely or locally (OSTIF Audit).

The issue has been fixed in Unbound version 1.9.5 and later. Various distributions have backported the fix to their maintained versions, including Ubuntu 20.04 LTS (focal) and 18.04 LTS (bionic) (Ubuntu Security).