Read the docs
TI-2020-06916 Aliases CVE-2020-8623GHSA-3hh5-h95j-2cw7

A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c

Priority MEDIUM 42CWE-617Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-617.

Summary

In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with "--enable-native-pkcs11" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker

Why it matters now

EPSS 0.06606 93rd percentileScored 2026-11-07
Fix Fixed BIND9 (ISC): 9.11.22, 9.16.6, 9.17.4Red Hat: 4 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ISCBIND99.10.0 and later; before 9.11.22; 9.12.0 and later; before 9.16.6; 9.17.0 and later; before 9.17.4; 9.10.5-S1 and later9.11.22, 9.16.6, 9.17.4Patch availableCNA
  • BIND9 VendorISC Affected 9.10.0 and later; before 9.11.22; 9.12.0 and later; before 9.16.6; 9.17.0 and later; before 9.17.4; 9.10.5-S1 and later Fixed in 9.11.22, 9.16.6, 9.17.4 Patch available CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*9.10.0 – 9.11.21; 9.12.1 – 9.16.5; 9.17.0 – 9.17.3VulnerableISC
cpe:2.3:a:isc:bind:9.10.5:s1:*:*:supported_preview:*:*:*9.10.5 s1VulnerableISC
cpe:2.3:a:isc:bind:9.11.21:s1:*:*:supported_preview:*:*:*9.11.21 s1VulnerableISC
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*15.2VulnerableopenSUSE
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*16.04VulnerableCanonical
  • cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* Versions 9.10.0 – 9.11.21; 9.12.1 – 9.16.5; 9.17.0 – 9.17.3 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.10.5:s1:*:*:supported_preview:*:*:* Versions 9.10.5 s1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.11.21:s1:*:*:supported_preview:*:*:* Versions 9.11.21 s1 Vulnerable ·ISC
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
cpe:2.3:a:synology:dns_server:*:*:*:*:*:*:*:*before 2.2.2-5027VulnerableSynology
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
  • cpe:2.3:a:synology:dns_server:*:*:*:*:*:*:*:* Versions before 2.2.2-5027 Vulnerable ·Synology
  • cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · CNA BIND9 (ISC) Fixed in 9.11.22, 9.16.6, 9.17.4

Red Hat 4 advisories

  • RHSA-2020:5203 Released 2020-11-24 · Red Hat rating Moderate
    bind security update
    • Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) bind-32:9.11.4-9.P2.el7_7.3, bind-export-libs-32:9.11.4-9.P2.el7_7.3, bind-libs-32:9.11.4-9.P2.el7_7.3 +3
    • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) bind-32:9.11.4-9.P2.el7_7.3, bind-chroot-32:9.11.4-9.P2.el7_7.3, bind-devel-32:9.11.4-9.P2.el7_7.3 +8
    • Red Hat Enterprise Linux Server EUS (v. 7.7) bind-32:9.11.4-9.P2.el7_7.3, bind-chroot-32:9.11.4-9.P2.el7_7.3, bind-export-libs-32:9.11.4-9.P2.el7_7.3 +11
    • Red Hat Enterprise Linux Server Optional EUS (v. 7.7) bind-devel-32:9.11.4-9.P2.el7_7.3, bind-devel-32:9.11.4-9.P2.el7_7.3.ppc, bind-export-devel-32:9.11.4-9.P2.el7_7.3 +7
  • RHSA-2020:5011 Released 2020-11-10 · Red Hat rating Moderate
    bind security and bug fix update
    • Red Hat Enterprise Linux Client (v. 7) bind-32:9.11.4-26.P2.el7_9.2, bind-export-libs-32:9.11.4-26.P2.el7_9.2, bind-libs-32:9.11.4-26.P2.el7_9.2 +3
    • Red Hat Enterprise Linux Client Optional (v. 7) bind-32:9.11.4-26.P2.el7_9.2, bind-chroot-32:9.11.4-26.P2.el7_9.2, bind-devel-32:9.11.4-26.P2.el7_9.2 +8
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) bind-32:9.11.4-26.P2.el7_9.2, bind-chroot-32:9.11.4-26.P2.el7_9.2, bind-devel-32:9.11.4-26.P2.el7_9.2 +8
    • Red Hat Enterprise Linux Server (v. 7) bind-32:9.11.4-26.P2.el7_9.2, bind-chroot-32:9.11.4-26.P2.el7_9.2, bind-export-libs-32:9.11.4-26.P2.el7_9.2 +11
    • Red Hat Enterprise Linux Server Optional (v. 7) bind-devel-32:9.11.4-26.P2.el7_9.2, bind-devel-32:9.11.4-26.P2.el7_9.2.ppc, bind-export-devel-32:9.11.4-26.P2.el7_9.2 +7
    • Red Hat Enterprise Linux Workstation (v. 7) bind-32:9.11.4-26.P2.el7_9.2, bind-chroot-32:9.11.4-26.P2.el7_9.2, bind-export-libs-32:9.11.4-26.P2.el7_9.2 +7
    • Red Hat Enterprise Linux Workstation Optional (v. 7) bind-devel-32:9.11.4-26.P2.el7_9.2, bind-export-devel-32:9.11.4-26.P2.el7_9.2, bind-lite-devel-32:9.11.4-26.P2.el7_9.2 +3
  • RHSA-2020:4992 Released 2020-11-10 · Red Hat rating Moderate
    bind security update
    • Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) bind-32:9.9.4-74.el7_6.5, bind-libs-32:9.9.4-74.el7_6.5, bind-libs-lite-32:9.9.4-74.el7_6.5 +2
    • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) bind-32:9.9.4-74.el7_6.5, bind-chroot-32:9.9.4-74.el7_6.5, bind-devel-32:9.9.4-74.el7_6.5 +7
    • Red Hat Enterprise Linux Server EUS (v. 7.6) bind-32:9.9.4-74.el7_6.5, bind-chroot-32:9.9.4-74.el7_6.5, bind-libs-32:9.9.4-74.el7_6.5 +8
    • Red Hat Enterprise Linux Server Optional EUS (v. 7.6) bind-devel-32:9.9.4-74.el7_6.5, bind-devel-32:9.9.4-74.el7_6.5.ppc, bind-lite-devel-32:9.9.4-74.el7_6.5 +9
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) bind-32:9.9.4-74.el7_6.5, bind-chroot-32:9.9.4-74.el7_6.5, bind-libs-32:9.9.4-74.el7_6.5 +6
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) bind-devel-32:9.9.4-74.el7_6.5, bind-lite-devel-32:9.9.4-74.el7_6.5, bind-pkcs11-32:9.9.4-74.el7_6.5 +5
Show 1 more Red Hat advisories
  • RHSA-2020:4500 Released 2020-11-04 · Red Hat rating Moderate
    bind security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) bind-32:9.11.20-5.el8, bind-chroot-32:9.11.20-5.el8, bind-devel-32:9.11.20-5.el8 +12
    • Red Hat Enterprise Linux BaseOS (v. 8) bind-32:9.11.20-5.el8, bind-export-devel-32:9.11.20-5.el8, bind-export-libs-32:9.11.20-5.el8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    ISC BIND9 — GLSA-202008-19

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2020-06913 Reachable assertion in ISC BIND9Priority LOW 39
    • TI-2020-06915 A truncated TSIG response can lead to an assertion failurePriority LOW 38
    • TI-2020-06914 Attempting QNAME minimization after forwarding can lead to an assertion failure in resolver.cPriority LOW 38
    Show all 5 records → Advisory →
  • Advisory ·

    ISC BIND9 — USN-4468-1

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2020-06913 Reachable assertion in ISC BIND9Priority LOW 39
    • TI-2020-06915 A truncated TSIG response can lead to an assertion failurePriority LOW 38
    • TI-2020-06914 Attempting QNAME minimization after forwarding can lead to an assertion failure in resolver.cPriority LOW 38
    Show all 5 records → Advisory →
Show 2 more groups
  • Advisory ·

    ISC BIND9 — FEDORA-2020-a02b7a0f21

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2020-06915 A truncated TSIG response can lead to an assertion failurePriority LOW 38
    • TI-2020-06917 update-policy rules of type "subdomain" are enforced incorrectlyPriority LOW 27
    Show all 3 records → Advisory →
  • Advisory ·

    ISC BIND9 — FEDORA-2020-14c194e5af

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2020-06915 A truncated TSIG response can lead to an assertion failurePriority LOW 38
    • TI-2020-06917 update-policy rules of type "subdomain" are enforced incorrectlyPriority LOW 27
    Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4500
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2020:4500
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)Fixed RHSA-2020:4992
Red Hat Enterprise Linux ComputeNode EUS (v. 7.7)Fixed RHSA-2020:5203
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)Fixed RHSA-2020:4992
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7)Fixed RHSA-2020:5203
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2020:4992
Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2020:5203
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux Server Optional EUS (v. 7.6)Fixed RHSA-2020:4992
Red Hat Enterprise Linux Server Optional EUS (v. 7.7)Fixed RHSA-2020:5203
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)Fixed RHSA-2020:4992
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)Fixed RHSA-2020:4992
Not affected: 2 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8623
  2. 2026-10-03 Alias added: GHSA-3hh5-h95j-2cw7

References

Advisory 11

  • TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
  • TI-2023-27571 Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related… CVSS 3.1HIGH 7.5
  • TI-2021-07476 A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack CVSS 3.1CRITICAL 9.8
  • TI-2023-27773 The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance… CVSS 3.1HIGH 7.5
  • TI-2020-06910 A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c CVSS 3.1HIGH 7.5
  • TI-2016-02320 buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x… CVSS 3.0HIGH 7.5
See all 192 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences