Assertion failure when unbound generates an empty error reply in response to a query

Hardy is just backports.

Fixed in oneiric.

unbound (1.4.10-1ubuntu1) oneiric; urgency=low

  * Merge from debian unstable. Remaining changes:
    - Fix build to work with default python other than python2.6
      - Generalize install rule in debian/python-unbound.install
      - Use pyversions -d to determine where to install .so files instead of
        hard coding python2.6
      - Remove hard coded XB-Python-Version: 2.6 from debian/control

 -- Scott Kitterman <email address hidden> Thu, 26 May 2011 15:44:54 -0400

unbound (1.4.10-1) unstable; urgency=low

  * New upstream release:
    - CVE-2011-1922.

 -- Robert S. Edmonds <email address hidden> Wed, 25 May 2011 15:48:34 -0700

The actual upstream change once you filter through all the tool cruft between 1.4.9 and 1.4.10. Also confirmed by looking at the upstream svn. See svn diff -c2419 in http://unbound.nlnetlabs.nl/svn/trunk/ . I may get time for debdiffs later, but here's the basic patch in case someone wants to run with it. It definitely applies to natty and needs investigation for lucid/maverick.

debdiff for Natty.

Remembered to add the bug number to debian/changelog

Testing done for Natty: None - This is the same change to 1.4.9 that upstream made for 1.4.10.

Thanks for the Natty debdiff. Update is building now and will be released today.

Unsubscribing ubuntu-security-sponsors for now. Please re-subscribe when another debdiff is attached. Thanks!

This bug was fixed in the package unbound - 1.4.9-0ubuntu1.1

---------------
unbound (1.4.9-0ubuntu1.1) natty-security; urgency=high

  * SECURITY UPDATE:
  * References: CVE 2011-1922 (LP: #788818)
  * Add debian/patches/30_cve2011-1922 backported from 1.4.10
 -- Scott Kitterman <email address hidden> Fri, 27 May 2011 00:23:21 -0400

Debdiff for maverick. Untested, but based on code inspection the relevant code is unchanged from the current release so direct backport should do it.

Debdiff for Lucid. Testing: None. Code inspection indicates the relevant code is unchanged and that backporting the upstream fix from 1.4.10 should be OK.

Based on looking at the diff, I don't think this issue is relevant to the version in hardy-backports.

Debdiffs look good, thanks

Uploaded lucid and maverick to the security ppa. Thanks for the debdiffs!

This bug was fixed in the package unbound - 1.4.5-1ubuntu1.1

---------------
unbound (1.4.5-1ubuntu1.1) maverick-security; urgency=low

  * SECURITY UPDATE:
  * References: CVE 2011-1922 (LP: #788818)
  * Add debian/patches/30_cve2011-1922 backported from 1.4.10
 -- Scott Kitterman <email address hidden> Sat, 28 May 2011 00:09:20 -0400

This bug was fixed in the package unbound - 1.4.1-2ubuntu0.1

---------------
unbound (1.4.1-2ubuntu0.1) lucid-security; urgency=low

  * SECURITY UPDATE:
  * References: CVE 2011-1922 (LP: #788818)
  * Add debian/patches/30_cve2011-1922 backported from 1.4.10
 -- Scott Kitterman <email address hidden> Sat, 28 May 2011 08:46:36 -0400