Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-38178: By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources. CVE-2022-38177: By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources. CVE-2022-2795: By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service. CVE-2021-25220: A cache poisoning vulnerability was found in BIND when using forwarders. Bogus NS records supplied by the forwarders may be cached and used by name if it needs to recurse for any reason. This issue causes it to obtain and pass on potentially incorrect answers. This flaw allows a remote attacker to manipulate cache results with incorrect records, leading to queries made to the wrong servers, possibly resulting in false information received on the client's end.
Fixed packages 17
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | bind | 32:9.11.4-26.P2.amzn2.13 |
| Amazon Linux · 2 | bind-chroot | 32:9.11.4-26.P2.amzn2.13 |
| Amazon Linux · 2 | bind-debuginfo | 32:9.11.4-26.P2.amzn2.13 |
| Amazon Linux · 2 | bind-devel | 32:9.11.4-26.P2.amzn2.13 |
| Amazon Linux · 2 | bind-export-devel | 32:9.11.4-26.P2.amzn2.13 |
| Amazon Linux · 2 | bind-export-libs | 32:9.11.4-26.P2.amzn2.13 |
| Amazon Linux · 2 | bind-libs | 32:9.11.4-26.P2.amzn2.13 |
| Amazon Linux · 2 | bind-libs-lite | 32:9.11.4-26.P2.amzn2.13 |
| Amazon Linux · 2 | bind-license | 32:9.11.4-26.P2.amzn2.13 |
| Amazon Linux · 2 | bind-lite-devel | 32:9.11.4-26.P2.amzn2.13 |
| Amazon Linux · 2 | bind-pkcs11 | 32:9.11.4-26.P2.amzn2.13 |
| Amazon Linux · 2 | bind-pkcs11-devel | 32:9.11.4-26.P2.amzn2.13 |
| Amazon Linux · 2 | bind-pkcs11-libs | 32:9.11.4-26.P2.amzn2.13 |
| Amazon Linux · 2 | bind-pkcs11-utils | 32:9.11.4-26.P2.amzn2.13 |
| Amazon Linux · 2 | bind-sdb | 32:9.11.4-26.P2.amzn2.13 |
| Amazon Linux · 2 | bind-sdb-chroot | 32:9.11.4-26.P2.amzn2.13 |
| Amazon Linux · 2 | bind-utils | 32:9.11.4-26.P2.amzn2.13 |
Vulnerabilities 4
-
High 7.5
Memory leak in ECDSA DNSSEC verification code
By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
-
High 7.5
Memory leaks in EdDSA DNSSEC verification code
By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
-
Medium 6.8
DNS forwarders - cache poisoning vulnerability
BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to…
-
Medium 5.3
Processing large delegations may severely degrade resolver performance
By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.