Read the docs
TI-2020-06915 Aliases CVE-2020-8622GHSA-fh6r-7j2f-pmw4

A truncated TSIG response can lead to an assertion failure

Priority LOW 38CWE-617Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 27 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-617.

Summary

In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.

Why it matters now

EPSS 0.05904 93rd percentileScored 2026-11-07
Fix Partial BIND9 (ISC): 9.11.22, 9.16.6, 9.17.4Red Hat: 5 advisoriesRed Hat: 27 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ISCBIND99.0.0 and later; before 9.11.22; 9.12.0 and later; before 9.16.6; 9.17.0 and later; before 9.17.4; 9.9.3-S1 and later9.11.22, 9.16.6, 9.17.4Patch availableCNA
  • BIND9 VendorISC Affected 9.0.0 and later; before 9.11.22; 9.12.0 and later; before 9.16.6; 9.17.0 and later; before 9.17.4; 9.9.3-S1 and later Fixed in 9.11.22, 9.16.6, 9.17.4 Patch available CNA

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*9.0.0 – 9.11.21; 9.12.0 – 9.16.5; 9.17.0 – 9.17.3VulnerableISC
cpe:2.3:a:isc:bind:9.9.3:s1:*:*:supported_preview:*:*:*9.9.3 s1VulnerableISC
cpe:2.3:a:isc:bind:9.11.21:s1:*:*:supported_preview:*:*:*9.11.21 s1VulnerableISC
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*12.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*14.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*16.04VulnerableCanonical
  • cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* Versions 9.0.0 – 9.11.21; 9.12.0 – 9.16.5; 9.17.0 – 9.17.3 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.9.3:s1:*:*:supported_preview:*:*:* Versions 9.9.3 s1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.11.21:s1:*:*:supported_preview:*:*:* Versions 9.11.21 s1 Vulnerable ·ISC
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* Versions 12.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*15.2VulnerableopenSUSE
cpe:2.3:a:synology:dns_server:*:*:*:*:*:*:*:*before 2.2.2-5028VulnerableSynology
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*8.0.0 – 8.5.0VulnerableOracle
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
  • cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
  • cpe:2.3:a:synology:dns_server:*:*:*:*:*:*:*:* Versions before 2.2.2-5028 Vulnerable ·Synology
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.5.0 Vulnerable ·Oracle

Remediation

  • Fix · CNA BIND9 (ISC) Fixed in 9.11.22, 9.16.6, 9.17.4

Red Hat 5 advisories

  • RHSA-2020:5203 Released 2020-11-24 · Red Hat rating Moderate
    bind security update
    • Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) bind-32:9.11.4-9.P2.el7_7.3, bind-export-libs-32:9.11.4-9.P2.el7_7.3, bind-libs-32:9.11.4-9.P2.el7_7.3 +3
    • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) bind-32:9.11.4-9.P2.el7_7.3, bind-chroot-32:9.11.4-9.P2.el7_7.3, bind-devel-32:9.11.4-9.P2.el7_7.3 +8
    • Red Hat Enterprise Linux Server EUS (v. 7.7) bind-32:9.11.4-9.P2.el7_7.3, bind-chroot-32:9.11.4-9.P2.el7_7.3, bind-export-libs-32:9.11.4-9.P2.el7_7.3 +11
    • Red Hat Enterprise Linux Server Optional EUS (v. 7.7) bind-devel-32:9.11.4-9.P2.el7_7.3, bind-devel-32:9.11.4-9.P2.el7_7.3.ppc, bind-export-devel-32:9.11.4-9.P2.el7_7.3 +7
  • RHSA-2020:5011 Released 2020-11-10 · Red Hat rating Moderate
    bind security and bug fix update
    • Red Hat Enterprise Linux Client (v. 7) bind-32:9.11.4-26.P2.el7_9.2, bind-export-libs-32:9.11.4-26.P2.el7_9.2, bind-libs-32:9.11.4-26.P2.el7_9.2 +3
    • Red Hat Enterprise Linux Client Optional (v. 7) bind-32:9.11.4-26.P2.el7_9.2, bind-chroot-32:9.11.4-26.P2.el7_9.2, bind-devel-32:9.11.4-26.P2.el7_9.2 +8
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) bind-32:9.11.4-26.P2.el7_9.2, bind-chroot-32:9.11.4-26.P2.el7_9.2, bind-devel-32:9.11.4-26.P2.el7_9.2 +8
    • Red Hat Enterprise Linux Server (v. 7) bind-32:9.11.4-26.P2.el7_9.2, bind-chroot-32:9.11.4-26.P2.el7_9.2, bind-export-libs-32:9.11.4-26.P2.el7_9.2 +11
    • Red Hat Enterprise Linux Server Optional (v. 7) bind-devel-32:9.11.4-26.P2.el7_9.2, bind-devel-32:9.11.4-26.P2.el7_9.2.ppc, bind-export-devel-32:9.11.4-26.P2.el7_9.2 +7
    • Red Hat Enterprise Linux Workstation (v. 7) bind-32:9.11.4-26.P2.el7_9.2, bind-chroot-32:9.11.4-26.P2.el7_9.2, bind-export-libs-32:9.11.4-26.P2.el7_9.2 +7
    • Red Hat Enterprise Linux Workstation Optional (v. 7) bind-devel-32:9.11.4-26.P2.el7_9.2, bind-export-devel-32:9.11.4-26.P2.el7_9.2, bind-lite-devel-32:9.11.4-26.P2.el7_9.2 +3
  • RHSA-2020:4992 Released 2020-11-10 · Red Hat rating Moderate
    bind security update
    • Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) bind-32:9.9.4-74.el7_6.5, bind-libs-32:9.9.4-74.el7_6.5, bind-libs-lite-32:9.9.4-74.el7_6.5 +2
    • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) bind-32:9.9.4-74.el7_6.5, bind-chroot-32:9.9.4-74.el7_6.5, bind-devel-32:9.9.4-74.el7_6.5 +7
    • Red Hat Enterprise Linux Server EUS (v. 7.6) bind-32:9.9.4-74.el7_6.5, bind-chroot-32:9.9.4-74.el7_6.5, bind-libs-32:9.9.4-74.el7_6.5 +8
    • Red Hat Enterprise Linux Server Optional EUS (v. 7.6) bind-devel-32:9.9.4-74.el7_6.5, bind-devel-32:9.9.4-74.el7_6.5.ppc, bind-lite-devel-32:9.9.4-74.el7_6.5 +9
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) bind-32:9.9.4-74.el7_6.5, bind-chroot-32:9.9.4-74.el7_6.5, bind-libs-32:9.9.4-74.el7_6.5 +6
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) bind-devel-32:9.9.4-74.el7_6.5, bind-lite-devel-32:9.9.4-74.el7_6.5, bind-pkcs11-32:9.9.4-74.el7_6.5 +5
Show 2 more Red Hat advisories
  • RHSA-2020:4500 Released 2020-11-04 · Red Hat rating Moderate
    bind security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) bind-32:9.11.20-5.el8, bind-chroot-32:9.11.20-5.el8, bind-devel-32:9.11.20-5.el8 +12
    • Red Hat Enterprise Linux BaseOS (v. 8) bind-32:9.11.20-5.el8, bind-export-devel-32:9.11.20-5.el8, bind-export-libs-32:9.11.20-5.el8
  • RHSA-2020:4183 Released 2020-10-07 · Red Hat rating Moderate
    bind security update
    • Red Hat Enterprise Linux Desktop (v. 6) bind-32:9.8.2-0.68.rc1.el6_10.8, bind-libs-32:9.8.2-0.68.rc1.el6_10.8, bind-utils-32:9.8.2-0.68.rc1.el6_10.8
    • Red Hat Enterprise Linux Desktop Optional (v. 6) bind-32:9.8.2-0.68.rc1.el6_10.8, bind-chroot-32:9.8.2-0.68.rc1.el6_10.8, bind-devel-32:9.8.2-0.68.rc1.el6_10.8 +1
    • Red Hat Enterprise Linux HPC Node (v. 6) bind-32:9.8.2-0.68.rc1.el6_10.8, bind-libs-32:9.8.2-0.68.rc1.el6_10.8, bind-utils-32:9.8.2-0.68.rc1.el6_10.8
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) bind-32:9.8.2-0.68.rc1.el6_10.8, bind-chroot-32:9.8.2-0.68.rc1.el6_10.8, bind-devel-32:9.8.2-0.68.rc1.el6_10.8 +1
    • Red Hat Enterprise Linux Server (v. 6) bind-32:9.8.2-0.68.rc1.el6_10.8, bind-chroot-32:9.8.2-0.68.rc1.el6_10.8, bind-libs-32:9.8.2-0.68.rc1.el6_10.8 +2
    • Red Hat Enterprise Linux Server Optional (v. 6) bind-devel-32:9.8.2-0.68.rc1.el6_10.8, bind-devel-32:9.8.2-0.68.rc1.el6_10.8.ppc, bind-sdb-32:9.8.2-0.68.rc1.el6_10.8
    • Red Hat Enterprise Linux Workstation (v. 6) bind-32:9.8.2-0.68.rc1.el6_10.8, bind-chroot-32:9.8.2-0.68.rc1.el6_10.8, bind-libs-32:9.8.2-0.68.rc1.el6_10.8 +1
    • Red Hat Enterprise Linux Workstation Optional (v. 6) bind-devel-32:9.8.2-0.68.rc1.el6_10.8, bind-sdb-32:9.8.2-0.68.rc1.el6_10.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    ISC BIND9 — GLSA-202008-19

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2020-06916 A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.cPriority MEDIUM 42
    • TI-2020-06913 Reachable assertion in ISC BIND9Priority LOW 39
    • TI-2020-06914 Attempting QNAME minimization after forwarding can lead to an assertion failure in resolver.cPriority LOW 38
    Show all 5 records → Advisory →
  • Advisory ·

    ISC BIND9 — USN-4468-1

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2020-06916 A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.cPriority MEDIUM 42
    • TI-2020-06913 Reachable assertion in ISC BIND9Priority LOW 39
    • TI-2020-06914 Attempting QNAME minimization after forwarding can lead to an assertion failure in resolver.cPriority LOW 38
    Show all 5 records → Advisory →
Show 2 more groups
  • Advisory ·

    ISC BIND9 — FEDORA-2020-a02b7a0f21

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2020-06916 A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.cPriority MEDIUM 42
    • TI-2020-06917 update-policy rules of type "subdomain" are enforced incorrectlyPriority LOW 27
    Show all 3 records → Advisory →
  • Advisory ·

    ISC BIND9 — FEDORA-2020-14c194e5af

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2020-06916 A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.cPriority MEDIUM 42
    • TI-2020-06917 update-policy rules of type "subdomain" are enforced incorrectlyPriority LOW 27
    Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4500
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2020:4500
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)Fixed RHSA-2020:4992
Red Hat Enterprise Linux ComputeNode EUS (v. 7.7)Fixed RHSA-2020:5203
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)Fixed RHSA-2020:4992
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7)Fixed RHSA-2020:5203
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2020:4183
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2020:4183
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2020:4183
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2020:4183
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2020:4183
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2020:4992
Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2020:5203
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2020:4183
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux Server Optional EUS (v. 7.6)Fixed RHSA-2020:4992
Red Hat Enterprise Linux Server Optional EUS (v. 7.7)Fixed RHSA-2020:5203
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2020:4183
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2020:4183
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)Fixed RHSA-2020:4992
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)Fixed RHSA-2020:4992

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8622
  2. 2026-10-03 Alias added: GHSA-fh6r-7j2f-pmw4

References

Patch 1

Advisory 12

  • TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
  • TI-2023-27571 Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related… CVSS 3.1HIGH 7.5
  • TI-2021-07476 A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack CVSS 3.1CRITICAL 9.8
  • TI-2023-27773 The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance… CVSS 3.1HIGH 7.5
  • TI-2020-06910 A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c CVSS 3.1HIGH 7.5
  • TI-2016-02320 buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x… CVSS 3.0HIGH 7.5
See all 192 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences