Red Hat Security AdvisoryRHSA-2020:3471
bind security update
Released 2020-08-18 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server AUS (v. 7.2) bind-32:9.9.4-29.el7_2.9, bind-chroot-32:9.9.4-29.el7_2.9, bind-libs-32:9.9.4-29.el7_2.9 +6
- Red Hat Enterprise Linux Server Optional AUS (v. 7.2) bind-devel-32:9.9.4-29.el7_2.9, bind-lite-devel-32:9.9.4-29.el7_2.9, bind-pkcs11-devel-32:9.9.4-29.el7_2.9 +2
Fixes 2 records
Priority HIGH 76
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.93332 · Published 2020-05-19 · Partial fix CWE-617
Priority MEDIUM 50
A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to…
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.1088 · Published 2020-05-19 · Partial fix CWE-400
