Skip to content
OpenAdvisories
Medium ALAS2-2020-1564 3 CVEs

Moderate: bind security update (Amazon Linux 2)

Published Dec 8, 2020 · Updated Dec 8, 2020

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-8624: A flaw was found in bind. Updates to "Update-policy" rules of type "subdomain" are treated as if they were of type "zonesub" which allows updates to all parts of the zone along with the intended subdomain. The highest threat from this vulnerability is to data integrity. 1869480: CVE-2020-8624 bind: incorrect enforcement of update-policy rules of type "subdomain" CVE-2020-8623: A flaw was found in bind. An assertion failure can occur when a specially crafted query for a zone signed with an RSA key. BIND must be compiled with "--enable-native-pkcs11" for the system to be affected. The highest threat from this vulnerability is to system availability. 1869477: CVE-2020-8623 bind: remotely triggerable assertion failure in pk11.c CVE-2020-8622: A flaw was found in bind. An assertion failure can occur when trying to verify a truncated response to a TSIG-signed request. The highest threat from this vulnerability is to system availability. 1869473: CVE-2020-8622 bind: truncated TSIG response can lead to an assertion failure

Fixed packages 17

ReleasePackageFixed in
Amazon Linux · 2 bind 32:9.11.4-26.P2.amzn2.2
Amazon Linux · 2 bind-chroot 32:9.11.4-26.P2.amzn2.2
Amazon Linux · 2 bind-debuginfo 32:9.11.4-26.P2.amzn2.2
Amazon Linux · 2 bind-devel 32:9.11.4-26.P2.amzn2.2
Amazon Linux · 2 bind-export-devel 32:9.11.4-26.P2.amzn2.2
Amazon Linux · 2 bind-export-libs 32:9.11.4-26.P2.amzn2.2
Amazon Linux · 2 bind-libs 32:9.11.4-26.P2.amzn2.2
Amazon Linux · 2 bind-libs-lite 32:9.11.4-26.P2.amzn2.2
Amazon Linux · 2 bind-license 32:9.11.4-26.P2.amzn2.2
Amazon Linux · 2 bind-lite-devel 32:9.11.4-26.P2.amzn2.2
Amazon Linux · 2 bind-pkcs11 32:9.11.4-26.P2.amzn2.2
Amazon Linux · 2 bind-pkcs11-devel 32:9.11.4-26.P2.amzn2.2
Amazon Linux · 2 bind-pkcs11-libs 32:9.11.4-26.P2.amzn2.2
Amazon Linux · 2 bind-pkcs11-utils 32:9.11.4-26.P2.amzn2.2
Amazon Linux · 2 bind-sdb 32:9.11.4-26.P2.amzn2.2
Amazon Linux · 2 bind-sdb-chroot 32:9.11.4-26.P2.amzn2.2
Amazon Linux · 2 bind-utils 32:9.11.4-26.P2.amzn2.2

Vulnerabilities 3

  • High 7.5
    CVE-2020-8623

    A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c

    In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulner…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2020-8622

    A truncated TSIG response can lead to an assertion failure

    In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, co…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine
  • Medium 4.3
    CVE-2020-8624

    update-policy rules of type "subdomain" are enforced incorrectly

    In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a sp…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-8622.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-8623.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-8624.html