Red Hat Security AdvisoryRHSA-2023:2792
bind9.16 security and bug fix update
Released 2023-05-16 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) bind9.16-32:9.16.23-0.14.el8, bind9.16-chroot-32:9.16.23-0.14.el8, bind9.16-dnssec-utils-32:9.16.23-0.14.el8 +4
- Red Hat Enterprise Linux CRB (v. 8) bind9.16-devel-32:9.16.23-0.14.el8, bind9.16-doc-32:9.16.23-0.14.el8, bind9.16-libs-32:9.16.23-0.14.el8
Fixes 4 records
Priority HIGH 69
BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.48427 · Published 2023-01-25 · Fixed CWE-20
Priority MEDIUM 55
This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.15989 · Published 2023-01-25 · Fixed CWE-617
Priority MEDIUM 53
Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.13213 · Published 2023-01-25 · Partial fix CWE-400
Priority LOW 34
By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02291 · Published 2022-09-21 · Partial fix
THREATIST.IORead the docs