Red Hat Security AdvisoryRHSA-2020:2404
bind security update
Released 2020-06-04 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream E4S (v. 8.0) bind-32:9.11.4-19.P2.el8_0, bind-chroot-32:9.11.4-19.P2.el8_0, bind-devel-32:9.11.4-19.P2.el8_0 +12
- Red Hat Enterprise Linux BaseOS E4S (v. 8.0) bind-32:9.11.4-19.P2.el8_0, bind-export-devel-32:9.11.4-19.P2.el8_0, bind-export-libs-32:9.11.4-19.P2.el8_0
Fixes 2 records
Priority HIGH 76
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.93332 · Published 2020-05-19 · Partial fix CWE-617
Priority MEDIUM 50
A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to…
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.1088 · Published 2020-05-19 · Partial fix CWE-400
