Red Hat Security Advisory

RHSA-2020:2383

bind security update

Released 2020-06-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop (v. 6) bind-32:9.8.2-0.68.rc1.el6_10.7, bind-libs-32:9.8.2-0.68.rc1.el6_10.7, bind-utils-32:9.8.2-0.68.rc1.el6_10.7
Red Hat Enterprise Linux Desktop Optional (v. 6) bind-32:9.8.2-0.68.rc1.el6_10.7, bind-chroot-32:9.8.2-0.68.rc1.el6_10.7, bind-devel-32:9.8.2-0.68.rc1.el6_10.7 +1
Red Hat Enterprise Linux HPC Node (v. 6) bind-32:9.8.2-0.68.rc1.el6_10.7, bind-libs-32:9.8.2-0.68.rc1.el6_10.7, bind-utils-32:9.8.2-0.68.rc1.el6_10.7
Red Hat Enterprise Linux HPC Node Optional (v. 6) bind-32:9.8.2-0.68.rc1.el6_10.7, bind-chroot-32:9.8.2-0.68.rc1.el6_10.7, bind-devel-32:9.8.2-0.68.rc1.el6_10.7 +1
Red Hat Enterprise Linux Server (v. 6) bind-32:9.8.2-0.68.rc1.el6_10.7, bind-chroot-32:9.8.2-0.68.rc1.el6_10.7, bind-libs-32:9.8.2-0.68.rc1.el6_10.7 +2
Red Hat Enterprise Linux Server Optional (v. 6) bind-devel-32:9.8.2-0.68.rc1.el6_10.7, bind-devel-32:9.8.2-0.68.rc1.el6_10.7.ppc, bind-sdb-32:9.8.2-0.68.rc1.el6_10.7
Red Hat Enterprise Linux Workstation (v. 6) bind-32:9.8.2-0.68.rc1.el6_10.7, bind-chroot-32:9.8.2-0.68.rc1.el6_10.7, bind-libs-32:9.8.2-0.68.rc1.el6_10.7 +1
Red Hat Enterprise Linux Workstation Optional (v. 6) bind-devel-32:9.8.2-0.68.rc1.el6_10.7, bind-sdb-32:9.8.2-0.68.rc1.el6_10.7

Fixes 2 records

TI-2020-06910 CVE-2020-8617 · GHSA-q6g5-8p95-hqh7

A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c

HIGH 76

Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.93332 Published 2020-05-19 Partial fix CWE-617

TI-2020-06909 CVE-2020-8616 · GHSA-rc96-hg8v-6p4g

BIND does not sufficiently limit the number of fetches performed when processing referrals

MEDIUM 50

A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.1088 Published 2020-05-19 Partial fix CWE-400