Skip to content
OpenAdvisories
High ALAS2-2023-2112 1 CVE

Important: bind security update (Amazon Linux 2)

Published Jul 5, 2023 · Updated Jul 19, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-2828: A vulnerability was found in BIND. The effectiveness of the cache-cleaning algorithm used in named can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured max-cache-size limit to exceed significantly.

Fixed packages 17

ReleasePackageFixed in
Amazon Linux · 2 bind 32:9.11.4-26.P2.amzn2.13.1
Amazon Linux · 2 bind-chroot 32:9.11.4-26.P2.amzn2.13.1
Amazon Linux · 2 bind-debuginfo 32:9.11.4-26.P2.amzn2.13.1
Amazon Linux · 2 bind-devel 32:9.11.4-26.P2.amzn2.13.1
Amazon Linux · 2 bind-export-devel 32:9.11.4-26.P2.amzn2.13.1
Amazon Linux · 2 bind-export-libs 32:9.11.4-26.P2.amzn2.13.1
Amazon Linux · 2 bind-libs 32:9.11.4-26.P2.amzn2.13.1
Amazon Linux · 2 bind-libs-lite 32:9.11.4-26.P2.amzn2.13.1
Amazon Linux · 2 bind-license 32:9.11.4-26.P2.amzn2.13.1
Amazon Linux · 2 bind-lite-devel 32:9.11.4-26.P2.amzn2.13.1
Amazon Linux · 2 bind-pkcs11 32:9.11.4-26.P2.amzn2.13.1
Amazon Linux · 2 bind-pkcs11-devel 32:9.11.4-26.P2.amzn2.13.1
Amazon Linux · 2 bind-pkcs11-libs 32:9.11.4-26.P2.amzn2.13.1
Amazon Linux · 2 bind-pkcs11-utils 32:9.11.4-26.P2.amzn2.13.1
Amazon Linux · 2 bind-sdb 32:9.11.4-26.P2.amzn2.13.1
Amazon Linux · 2 bind-sdb-chroot 32:9.11.4-26.P2.amzn2.13.1
Amazon Linux · 2 bind-utils 32:9.11.4-26.P2.amzn2.13.1

Vulnerabilities 1

  • High 7.5
    CVE-2023-2828

    named's configured cache size limit can be significantly exceeded

    Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size`…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-2828.html