Skip to content
OpenAdvisories
High ALAS2023-2023-240 2 CVEs

Important: bind security update (Amazon Linux 2023)

Published Jul 5, 2023 · Updated Jul 20, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-2911: If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33 through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1. CVE-2023-2828: A vulnerability was found in BIND. The effectiveness of the cache-cleaning algorithm used in named can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured max-cache-size limit to exceed significantly.

Fixed packages 30

ReleasePackageFixed in
Amazon Linux · 2023 bind 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-chroot 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-debuginfo 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-debugsource 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-devel 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-dlz-filesystem 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-dlz-filesystem-debuginfo 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-dlz-ldap 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-dlz-ldap-debuginfo 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-dlz-mysql 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-dlz-mysql-debuginfo 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-dlz-sqlite3 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-dlz-sqlite3-debuginfo 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-dnssec-doc 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-dnssec-utils 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-dnssec-utils-debuginfo 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-doc 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-libs 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-libs-debuginfo 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-license 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-pkcs11 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-pkcs11-debuginfo 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-pkcs11-devel 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-pkcs11-libs 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-pkcs11-libs-debuginfo 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-pkcs11-utils 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-pkcs11-utils-debuginfo 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-utils 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 bind-utils-debuginfo 32:9.16.42-1.amzn2023.0.1
Amazon Linux · 2023 python3-bind 32:9.16.42-1.amzn2023.0.1

Vulnerabilities 2

  • High 7.5
    CVE-2023-2828

    named's configured cache size limit can be significantly exceeded

    Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size`…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2023-2911

    Exceeding the recursive-clients quota may cause named to terminate unexpectedly when stale-answer-client-timeout is set to 0

    If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a st…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-2828.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-2911.html