Red Hat Security AdvisoryRHSA-2020:3475
bind security update
Released 2020-08-18 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) bind-32:9.9.4-74.el7_6.4, bind-libs-32:9.9.4-74.el7_6.4, bind-libs-lite-32:9.9.4-74.el7_6.4 +2
- Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) bind-32:9.9.4-74.el7_6.4, bind-chroot-32:9.9.4-74.el7_6.4, bind-devel-32:9.9.4-74.el7_6.4 +7
- Red Hat Enterprise Linux Server EUS (v. 7.6) bind-32:9.9.4-74.el7_6.4, bind-chroot-32:9.9.4-74.el7_6.4, bind-libs-32:9.9.4-74.el7_6.4 +8
- Red Hat Enterprise Linux Server Optional EUS (v. 7.6) bind-devel-32:9.9.4-74.el7_6.4, bind-devel-32:9.9.4-74.el7_6.4.ppc, bind-lite-devel-32:9.9.4-74.el7_6.4 +9
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) bind-32:9.9.4-74.el7_6.4, bind-chroot-32:9.9.4-74.el7_6.4, bind-libs-32:9.9.4-74.el7_6.4 +6
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) bind-devel-32:9.9.4-74.el7_6.4, bind-lite-devel-32:9.9.4-74.el7_6.4, bind-pkcs11-32:9.9.4-74.el7_6.4 +5
Fixes 2 records
Priority HIGH 76
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.93332 · Published 2020-05-19 · Partial fix CWE-617
Priority MEDIUM 50
A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to…
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.1088 · Published 2020-05-19 · Partial fix CWE-400
