Red Hat Security AdvisoryRHSA-2020:2338
bind security update
Released 2020-05-28 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) bind-32:9.11.13-5.el8_2, bind-chroot-32:9.11.13-5.el8_2, bind-devel-32:9.11.13-5.el8_2 +12
- Red Hat Enterprise Linux BaseOS (v. 8) bind-32:9.11.13-5.el8_2, bind-export-devel-32:9.11.13-5.el8_2, bind-export-libs-32:9.11.13-5.el8_2
Fixes 2 records
Priority HIGH 76
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.93332 · Published 2020-05-19 · Partial fix CWE-617
Priority MEDIUM 50
A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to…
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.1088 · Published 2020-05-19 · Partial fix CWE-400
