Red Hat Security Advisory

RHSA-2020:2893

bind security update

Released 2020-07-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) bind-32:9.11.4-9.P2.el7_7.1, bind-export-libs-32:9.11.4-9.P2.el7_7.1, bind-libs-32:9.11.4-9.P2.el7_7.1 +3
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) bind-32:9.11.4-9.P2.el7_7.1, bind-chroot-32:9.11.4-9.P2.el7_7.1, bind-devel-32:9.11.4-9.P2.el7_7.1 +8
Red Hat Enterprise Linux Server EUS (v. 7.7) bind-32:9.11.4-9.P2.el7_7.1, bind-chroot-32:9.11.4-9.P2.el7_7.1, bind-export-libs-32:9.11.4-9.P2.el7_7.1 +11
Red Hat Enterprise Linux Server Optional EUS (v. 7.7) bind-devel-32:9.11.4-9.P2.el7_7.1, bind-devel-32:9.11.4-9.P2.el7_7.1.ppc, bind-export-devel-32:9.11.4-9.P2.el7_7.1 +7

Fixes 1 record

TI-2020-06910 CVE-2020-8617 · GHSA-q6g5-8p95-hqh7

A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c

HIGH 76

Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.93332 Published 2020-05-19 Partial fix CWE-617