Red Hat Security Advisory

RHSA-2024:2720

bind and dhcp security update

Released 2024-05-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v.8.6) bind-32:9.11.36-3.el8_6.7, bind-chroot-32:9.11.36-3.el8_6.7, bind-devel-32:9.11.36-3.el8_6.7 +12
Red Hat Enterprise Linux BaseOS EUS (v.8.6) bind-32:9.11.36-3.el8_6.7, bind-export-devel-32:9.11.36-3.el8_6.7, bind-export-libs-32:9.11.36-3.el8_6.7 +6

Fixes 6 records

TI-2023-27571 CVE-2023-50387 · GHSA-8459-gg55-8qjj

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related…

HIGH 84

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.9999 Published 2024-02-14 Fixed CWE-770

TI-2023-27773 CVE-2023-50868 · GHSA-pv4h-p8jr-6cv2

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance…

HIGH 77

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.74295 Published 2024-02-14 Fixed CWE-400

TI-2022-02855 CVE-2022-3094 · GHSA-8f7f-g9cj-hq6g

An UPDATE message flood may cause named to exhaust all available memory

MEDIUM 53

Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.13213 Published 2023-01-25 Partial fix CWE-400

TI-2023-04070 CVE-2023-4408 · GHSA-x57x-3c65-5f3j

Parsing large DNS messages may cause excessive CPU load

LOW 36

The DNS message parsing code in `named` includes a section whose computational complexity is overly high.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01387 Published 2024-02-13 Partial fix CWE-407

TI-2021-07480 CVE-2021-25220 · GHSA-v8rf-mvwx-cx29

DNS forwarders - cache poisoning vulnerability

LOW 36

BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.0345 Published 2022-03-23 Fixed CWE-444

TI-2022-02590 CVE-2022-2795 · GHSA-9mq2-v988-m7mr

Processing large delegations may severely degrade resolver performance

LOW 34

By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02291 Published 2022-09-21 Partial fix