Read the docs
TI-2020-06917 Aliases CVE-2020-8624GHSA-qgv6-6x66-mr9j

update-policy rules of type "subdomain" are enforced incorrectly

Priority LOW 27CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-269.

Summary

In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone.

Why it matters now

EPSS 0.0382 90th percentileScored 2026-11-07
Fix Fixed BIND9 (ISC): 9.11.22, 9.16.6, 9.17.4 +1Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ISCBIND99.9.12 and later; up to 9.9.13; 9.10.7 and later; up to 9.10.8; 9.11.3 and later; before 9.11.22; 9.12.1 and later; before 9.16.6; 9.17.0 and later; before 9.17.4; 9.9.12-S1 and later; up to 9.9.13-S1; 9.11.3-S1 and later; before 9.11.22-S19.11.22, 9.16.6, 9.17.4, 9.11.22-S1Patch availableCNA
  • BIND9 VendorISC Affected 9.9.12 and later; up to 9.9.13; 9.10.7 and later; up to 9.10.8; 9.11.3 and later; before 9.11.22; 9.12.1 and later; before 9.16.6; 9.17.0 and later; before 9.17.4; 9.9.12-S1 and later; up to 9.9.13-S1; 9.11.3-S1 and later; before 9.11.22-S1 Fixed in 9.11.22, 9.16.6, 9.17.4, 9.11.22-S1 Patch available CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*9.9.12 – 9.9.13; 9.10.7 – 9.10.8; 9.11.3 – 9.11.21; 9.12.1 – 9.16.5; 9.17.0 – 9.17.3VulnerableISC
cpe:2.3:a:isc:bind:9.9.12:s1:*:*:supported_preview:*:*:*9.9.12 s1VulnerableISC
cpe:2.3:a:isc:bind:9.9.13:s1:*:*:supported_preview:*:*:*9.9.13 s1VulnerableISC
cpe:2.3:a:isc:bind:9.11.3:s1:*:*:supported_preview:*:*:*9.11.3 s1VulnerableISC
cpe:2.3:a:isc:bind:9.11.21:s1:*:*:supported_preview:*:*:*9.11.21 s1VulnerableISC
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* Versions 9.9.12 – 9.9.13; 9.10.7 – 9.10.8; 9.11.3 – 9.11.21; 9.12.1 – 9.16.5; 9.17.0 – 9.17.3 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.9.12:s1:*:*:supported_preview:*:*:* Versions 9.9.12 s1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.9.13:s1:*:*:supported_preview:*:*:* Versions 9.9.13 s1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.11.3:s1:*:*:supported_preview:*:*:* Versions 9.11.3 s1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.11.21:s1:*:*:supported_preview:*:*:* Versions 9.11.21 s1 Vulnerable ·ISC
  • cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*15.2VulnerableopenSUSE
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE

Remediation

  • Fix · CNA BIND9 (ISC) Fixed in 9.11.22, 9.16.6, 9.17.4, 9.11.22-S1

Red Hat 3 advisories

  • RHSA-2020:5203 Released 2020-11-24 · Red Hat rating Moderate
    bind security update
    • Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) bind-32:9.11.4-9.P2.el7_7.3, bind-export-libs-32:9.11.4-9.P2.el7_7.3, bind-libs-32:9.11.4-9.P2.el7_7.3 +3
    • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) bind-32:9.11.4-9.P2.el7_7.3, bind-chroot-32:9.11.4-9.P2.el7_7.3, bind-devel-32:9.11.4-9.P2.el7_7.3 +8
    • Red Hat Enterprise Linux Server EUS (v. 7.7) bind-32:9.11.4-9.P2.el7_7.3, bind-chroot-32:9.11.4-9.P2.el7_7.3, bind-export-libs-32:9.11.4-9.P2.el7_7.3 +11
    • Red Hat Enterprise Linux Server Optional EUS (v. 7.7) bind-devel-32:9.11.4-9.P2.el7_7.3, bind-devel-32:9.11.4-9.P2.el7_7.3.ppc, bind-export-devel-32:9.11.4-9.P2.el7_7.3 +7
  • RHSA-2020:5011 Released 2020-11-10 · Red Hat rating Moderate
    bind security and bug fix update
    • Red Hat Enterprise Linux Client (v. 7) bind-32:9.11.4-26.P2.el7_9.2, bind-export-libs-32:9.11.4-26.P2.el7_9.2, bind-libs-32:9.11.4-26.P2.el7_9.2 +3
    • Red Hat Enterprise Linux Client Optional (v. 7) bind-32:9.11.4-26.P2.el7_9.2, bind-chroot-32:9.11.4-26.P2.el7_9.2, bind-devel-32:9.11.4-26.P2.el7_9.2 +8
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) bind-32:9.11.4-26.P2.el7_9.2, bind-chroot-32:9.11.4-26.P2.el7_9.2, bind-devel-32:9.11.4-26.P2.el7_9.2 +8
    • Red Hat Enterprise Linux Server (v. 7) bind-32:9.11.4-26.P2.el7_9.2, bind-chroot-32:9.11.4-26.P2.el7_9.2, bind-export-libs-32:9.11.4-26.P2.el7_9.2 +11
    • Red Hat Enterprise Linux Server Optional (v. 7) bind-devel-32:9.11.4-26.P2.el7_9.2, bind-devel-32:9.11.4-26.P2.el7_9.2.ppc, bind-export-devel-32:9.11.4-26.P2.el7_9.2 +7
    • Red Hat Enterprise Linux Workstation (v. 7) bind-32:9.11.4-26.P2.el7_9.2, bind-chroot-32:9.11.4-26.P2.el7_9.2, bind-export-libs-32:9.11.4-26.P2.el7_9.2 +7
    • Red Hat Enterprise Linux Workstation Optional (v. 7) bind-devel-32:9.11.4-26.P2.el7_9.2, bind-export-devel-32:9.11.4-26.P2.el7_9.2, bind-lite-devel-32:9.11.4-26.P2.el7_9.2 +3
  • RHSA-2020:4500 Released 2020-11-04 · Red Hat rating Moderate
    bind security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) bind-32:9.11.20-5.el8, bind-chroot-32:9.11.20-5.el8, bind-devel-32:9.11.20-5.el8 +12
    • Red Hat Enterprise Linux BaseOS (v. 8) bind-32:9.11.20-5.el8, bind-export-devel-32:9.11.20-5.el8, bind-export-libs-32:9.11.20-5.el8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    ISC BIND9 — GLSA-202008-19

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2020-06916 A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.cPriority MEDIUM 42
    • TI-2020-06913 Reachable assertion in ISC BIND9Priority LOW 39
    • TI-2020-06915 A truncated TSIG response can lead to an assertion failurePriority LOW 38
    Show all 5 records → Advisory →
  • Advisory ·

    ISC BIND9 — USN-4468-1

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2020-06916 A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.cPriority MEDIUM 42
    • TI-2020-06913 Reachable assertion in ISC BIND9Priority LOW 39
    • TI-2020-06915 A truncated TSIG response can lead to an assertion failurePriority LOW 38
    Show all 5 records → Advisory →
Show 2 more groups
  • Advisory ·

    ISC BIND9 — FEDORA-2020-a02b7a0f21

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2020-06916 A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.cPriority MEDIUM 42
    • TI-2020-06915 A truncated TSIG response can lead to an assertion failurePriority LOW 38
    Show all 3 records → Advisory →
  • Advisory ·

    ISC BIND9 — FEDORA-2020-14c194e5af

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2020-06916 A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.cPriority MEDIUM 42
    • TI-2020-06915 A truncated TSIG response can lead to an assertion failurePriority LOW 38
    Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4500
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2020:4500
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux ComputeNode EUS (v. 7.7)Fixed RHSA-2020:5203
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7)Fixed RHSA-2020:5203
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2020:5203
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux Server Optional EUS (v. 7.7)Fixed RHSA-2020:5203
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:5011
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2020:5011
Not affected: 2 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8624
  2. 2026-10-03 Alias added: GHSA-qgv6-6x66-mr9j
  3. 2026-10-28 EPSS moved to the 90th–95th percentile

References

Advisory 10

  • TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
  • TI-2023-27571 Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related… CVSS 3.1HIGH 7.5
  • TI-2021-07476 A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack CVSS 3.1CRITICAL 9.8
  • TI-2023-27773 The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance… CVSS 3.1HIGH 7.5
  • TI-2020-06910 A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c CVSS 3.1HIGH 7.5
  • TI-2016-02320 buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x… CVSS 3.0HIGH 7.5
See all 192 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences