Skip to content
OpenAdvisories
High ALSA-2022:6781 3 CVEs

Important: bind9.16 security update

Published Oct 4, 2022 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

* bind: BIND 9 resolvers configured to answer from cache with zero stale-answer-timeout may terminate unexpectedly (CVE-2022-3080)
* bind: memory leak in ECDSA DNSSEC verification code (CVE-2022-38177)
* bind: memory leaks in EdDSA DNSSEC verification code (CVE-2022-38178)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 9

ReleasePackageFixed in
AlmaLinux · 8 bind9.16 32:9.16.23-0.7.el8_6.1
AlmaLinux · 8 bind9.16-chroot 32:9.16.23-0.7.el8_6.1
AlmaLinux · 8 bind9.16-devel 32:9.16.23-0.7.el8_6.1
AlmaLinux · 8 bind9.16-dnssec-utils 32:9.16.23-0.7.el8_6.1
AlmaLinux · 8 bind9.16-doc 32:9.16.23-0.7.el8_6.1
AlmaLinux · 8 bind9.16-libs 32:9.16.23-0.7.el8_6.1
AlmaLinux · 8 bind9.16-license 32:9.16.23-0.7.el8_6.1
AlmaLinux · 8 bind9.16-utils 32:9.16.23-0.7.el8_6.1
AlmaLinux · 8 python3-bind9.16 32:9.16.23-0.7.el8_6.1

Vulnerabilities 3

  • High 7.5
    CVE-2022-3080

    BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly

    By sending specific queries to the resolver, an attacker can cause named to crash.

    ISC BIND9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2022-38177

    Memory leak in ECDSA DNSSEC verification code

    By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

    ISC BIND9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2022-38178

    Memory leaks in EdDSA DNSSEC verification code

    By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

    ISC BIND9 bind9 bind9 Debian Ubuntu Azure Linux Alpine

References

  • report
    https://access.redhat.com/security/cve/CVE-2022-3080
  • report
    https://access.redhat.com/security/cve/CVE-2022-38177
  • report
    https://access.redhat.com/security/cve/CVE-2022-38178
  • report
    https://bugzilla.redhat.com/2128600
  • report
    https://bugzilla.redhat.com/2128601
  • report
    https://bugzilla.redhat.com/2128602
  • advisory
    https://errata.almalinux.org/8/ALSA-2022-6781.html