Red Hat Security Advisory

RHSA-2020:1061

bind security and bug fix update

Released 2020-03-31 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) bind-32:9.11.4-16.P2.el7, bind-export-libs-32:9.11.4-16.P2.el7, bind-libs-32:9.11.4-16.P2.el7 +3
Red Hat Enterprise Linux Client Optional (v. 7) bind-32:9.11.4-16.P2.el7, bind-chroot-32:9.11.4-16.P2.el7, bind-devel-32:9.11.4-16.P2.el7 +8
Red Hat Enterprise Linux ComputeNode (v. 7) bind-32:9.11.4-16.P2.el7, bind-export-libs-32:9.11.4-16.P2.el7, bind-libs-32:9.11.4-16.P2.el7 +3
Red Hat Enterprise Linux ComputeNode Optional (v. 7) bind-32:9.11.4-16.P2.el7, bind-chroot-32:9.11.4-16.P2.el7, bind-devel-32:9.11.4-16.P2.el7 +8
Red Hat Enterprise Linux Server (v. 7) bind-32:9.11.4-16.P2.el7, bind-chroot-32:9.11.4-16.P2.el7, bind-export-libs-32:9.11.4-16.P2.el7 +11
Red Hat Enterprise Linux Server Optional (v. 7) bind-devel-32:9.11.4-16.P2.el7, bind-devel-32:9.11.4-16.P2.el7.ppc, bind-export-devel-32:9.11.4-16.P2.el7 +7
Red Hat Enterprise Linux Workstation (v. 7) bind-32:9.11.4-16.P2.el7, bind-chroot-32:9.11.4-16.P2.el7, bind-export-libs-32:9.11.4-16.P2.el7 +7
Red Hat Enterprise Linux Workstation Optional (v. 7) bind-devel-32:9.11.4-16.P2.el7, bind-export-devel-32:9.11.4-16.P2.el7, bind-lite-devel-32:9.11.4-16.P2.el7 +3

Fixes 3 records

TI-2019-04541 CVE-2019-6477 · GHSA-6q2x-892r-7qm4

TCP-pipelined queries can bypass tcp-clients limit

MEDIUM 40

With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04134 Published 2019-11-26 Fixed CWE-400

TI-2019-04530 CVE-2019-6465 · GHSA-5hgv-gr6q-xvqx

Zone transfer controls for writable DLZ zones were not effective

LOW 31

Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions 9.…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03979 Published 2019-10-09 Partial fix CWE-732

TI-2018-04152 CVE-2018-5745 · GHSA-p5r3-98fj-vgcv

An assertion failure can occur if a trust anchor rolls over to an unsupported key algorithm when using managed-keys

LOW 27

"managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.02293 Published 2019-10-09 Partial fix CWE-327