Red Hat Security Advisory

RHSA-2023:2261

bind security and bug fix update

Released 2023-05-09 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) bind-32:9.16.23-11.el9, bind-chroot-32:9.16.23-11.el9, bind-dnssec-doc-32:9.16.23-11.el9 +5
Red Hat Enterprise Linux CRB (v. 9) bind-devel-32:9.16.23-11.el9, bind-doc-32:9.16.23-11.el9, bind-libs-32:9.16.23-11.el9

Fixes 4 records

TI-2022-03431 CVE-2022-3736 · GHSA-5v6f-5gpq-2628

named configured to answer from stale cache may terminate unexpectedly while processing RRSIG queries

HIGH 69

BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.48427 Published 2023-01-25 Fixed CWE-20

TI-2022-03599 CVE-2022-3924 · GHSA-29px-hvx8-j7xf

named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota

MEDIUM 55

This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.15989 Published 2023-01-25 Fixed CWE-617

TI-2022-02855 CVE-2022-3094 · GHSA-8f7f-g9cj-hq6g

An UPDATE message flood may cause named to exhaust all available memory

MEDIUM 53

Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.13213 Published 2023-01-25 Partial fix CWE-400

TI-2022-02590 CVE-2022-2795 · GHSA-9mq2-v988-m7mr

Processing large delegations may severely degrade resolver performance

LOW 34

By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02291 Published 2022-09-21 Partial fix