Skip to content
OpenAdvisories
High ALAS2-2021-1614 1 CVE

Important: bind security update (Amazon Linux 2)

Published Mar 18, 2021 · Updated Mar 19, 2021

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-8625: A buffer overflow flaw was found in the SPNEGO implementation used by BIND. This flaw allows a remote attacker to cause the named process to crash or possibly perform remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. 1928486: CVE-2020-8625 bind: Buffer overflow in the SPNEGO implementation affecting GSSAPI security policy negotiation

Fixed packages 17

ReleasePackageFixed in
Amazon Linux · 2 bind 32:9.11.4-26.P2.amzn2.4
Amazon Linux · 2 bind-chroot 32:9.11.4-26.P2.amzn2.4
Amazon Linux · 2 bind-debuginfo 32:9.11.4-26.P2.amzn2.4
Amazon Linux · 2 bind-devel 32:9.11.4-26.P2.amzn2.4
Amazon Linux · 2 bind-export-devel 32:9.11.4-26.P2.amzn2.4
Amazon Linux · 2 bind-export-libs 32:9.11.4-26.P2.amzn2.4
Amazon Linux · 2 bind-libs 32:9.11.4-26.P2.amzn2.4
Amazon Linux · 2 bind-libs-lite 32:9.11.4-26.P2.amzn2.4
Amazon Linux · 2 bind-license 32:9.11.4-26.P2.amzn2.4
Amazon Linux · 2 bind-lite-devel 32:9.11.4-26.P2.amzn2.4
Amazon Linux · 2 bind-pkcs11 32:9.11.4-26.P2.amzn2.4
Amazon Linux · 2 bind-pkcs11-devel 32:9.11.4-26.P2.amzn2.4
Amazon Linux · 2 bind-pkcs11-libs 32:9.11.4-26.P2.amzn2.4
Amazon Linux · 2 bind-pkcs11-utils 32:9.11.4-26.P2.amzn2.4
Amazon Linux · 2 bind-sdb 32:9.11.4-26.P2.amzn2.4
Amazon Linux · 2 bind-sdb-chroot 32:9.11.4-26.P2.amzn2.4
Amazon Linux · 2 bind-utils 32:9.11.4-26.P2.amzn2.4

Vulnerabilities 1

  • High 8.1
    CVE-2020-8625 EPSS 65%

    A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack

    BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicit…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-8625.html