Read the docs
TI-2020-06912 Aliases CVE-2020-8619GHSA-fw3j-5rrr-7j3r

A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer

Priority LOW 27CWE-404Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-404.

Summary

In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk ("*") character, this defect cannot be encountered. A would-be attacker who is allowed to change zone content could theoretically introduce such a record in order to exploit this condition to cause denial of service, though we consider the use of this vector unlikely because any such attack would require a significant privilege level and be easily traceable.

Why it matters now

EPSS 0.02146 82nd percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ISCBIND99.11.14 through versions before 9.11.20; 9.16.0 through versions before 9.16.4; 9.11.14-S1 through versions before 9.11.20-S1; 9.14.9 through versions 9.14.12—No fix listedCNA
  • BIND9 VendorISC Affected 9.11.14 through versions before 9.11.20; 9.16.0 through versions before 9.16.4; 9.11.14-S1 through versions before 9.11.20-S1; 9.14.9 through versions 9.14.12 Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*9.11.14 – 9.11.19VulnerableISC
cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*9.11.14-s1 – 9.11.19-s1VulnerableISC
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*9.14.9 – 9.14.12; 9.16.0 – 9.16.3VulnerableISC
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*15.2VulnerableopenSUSE
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* Versions 9.11.14 – 9.11.19 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:* Versions 9.11.14-s1 – 9.11.19-s1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* Versions 9.14.9 – 9.14.12; 9.16.0 – 9.16.3 Vulnerable ·ISC
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
  • cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

Red Hat 1 advisory

  • RHSA-2020:4500 Released 2020-11-04 · Red Hat rating Moderate
    bind security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) bind-32:9.11.20-5.el8, bind-chroot-32:9.11.20-5.el8, bind-devel-32:9.11.20-5.el8 +12
    • Red Hat Enterprise Linux BaseOS (v. 8) bind-32:9.11.20-5.el8, bind-export-devel-32:9.11.20-5.el8, bind-export-libs-32:9.11.20-5.el8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    ISC BIND9 — USN-4399-1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2020-06911 A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transferPriority LOW 26
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4500
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2020:4500
Not affected: 3 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8619
  2. 2026-10-03 Alias added: GHSA-fw3j-5rrr-7j3r

References

Advisory 8

  • TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
  • TI-2023-27571 Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related… CVSS 3.1HIGH 7.5
  • TI-2021-07476 A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack CVSS 3.1CRITICAL 9.8
  • TI-2023-27773 The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance… CVSS 3.1HIGH 7.5
  • TI-2020-06910 A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c CVSS 3.1HIGH 7.5
  • TI-2016-02320 buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x… CVSS 3.0HIGH 7.5
See all 192 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences