Skip to content
OpenAdvisories
High ALAS2-2021-1635 1 CVE

Important: bind security update (Amazon Linux 2)

Published May 20, 2021 · Updated May 24, 2021

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-25215: A flaw was found in bind. The way DNAME records are processed may trigger the same RRset to the ANSWER section to be added more than once which causes an assertion check to fail. The highest threat from this flaw is to system availability. 1953857: CVE-2021-25215 bind: An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself

Fixed packages 17

ReleasePackageFixed in
Amazon Linux · 2 bind 32:9.11.4-26.P2.amzn2.5
Amazon Linux · 2 bind-chroot 32:9.11.4-26.P2.amzn2.5
Amazon Linux · 2 bind-debuginfo 32:9.11.4-26.P2.amzn2.5
Amazon Linux · 2 bind-devel 32:9.11.4-26.P2.amzn2.5
Amazon Linux · 2 bind-export-devel 32:9.11.4-26.P2.amzn2.5
Amazon Linux · 2 bind-export-libs 32:9.11.4-26.P2.amzn2.5
Amazon Linux · 2 bind-libs 32:9.11.4-26.P2.amzn2.5
Amazon Linux · 2 bind-libs-lite 32:9.11.4-26.P2.amzn2.5
Amazon Linux · 2 bind-license 32:9.11.4-26.P2.amzn2.5
Amazon Linux · 2 bind-lite-devel 32:9.11.4-26.P2.amzn2.5
Amazon Linux · 2 bind-pkcs11 32:9.11.4-26.P2.amzn2.5
Amazon Linux · 2 bind-pkcs11-devel 32:9.11.4-26.P2.amzn2.5
Amazon Linux · 2 bind-pkcs11-libs 32:9.11.4-26.P2.amzn2.5
Amazon Linux · 2 bind-pkcs11-utils 32:9.11.4-26.P2.amzn2.5
Amazon Linux · 2 bind-sdb 32:9.11.4-26.P2.amzn2.5
Amazon Linux · 2 bind-sdb-chroot 32:9.11.4-26.P2.amzn2.5
Amazon Linux · 2 bind-utils 32:9.11.4-26.P2.amzn2.5

Vulnerabilities 1

  • High 7.5
    CVE-2021-25215 EPSS 12%

    An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself

    In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version o…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-25215.html