Skip to content
OpenAdvisories
Medium ALSA-2023:2261 4 CVEs

Moderate: bind security and bug fix update

Published May 9, 2023 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

* bind: processing large delegations may severely degrade resolver performance (CVE-2022-2795)
* bind: flooding with UPDATE requests may lead to DoS (CVE-2022-3094)
* bind: sending specific queries to the resolver may cause a DoS (CVE-2022-3736)
* bind: sending specific queries to the resolver may cause a DoS (CVE-2022-3924)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 10

ReleasePackageFixed in
AlmaLinux · 9 bind 32:9.16.23-11.el9
AlmaLinux · 9 bind-chroot 32:9.16.23-11.el9
AlmaLinux · 9 bind-devel 32:9.16.23-11.el9
AlmaLinux · 9 bind-dnssec-doc 32:9.16.23-11.el9
AlmaLinux · 9 bind-dnssec-utils 32:9.16.23-11.el9
AlmaLinux · 9 bind-doc 32:9.16.23-11.el9
AlmaLinux · 9 bind-libs 32:9.16.23-11.el9
AlmaLinux · 9 bind-license 32:9.16.23-11.el9
AlmaLinux · 9 bind-utils 32:9.16.23-11.el9
AlmaLinux · 9 python3-bind 32:9.16.23-11.el9

Vulnerabilities 4

  • High 7.5
    CVE-2022-3094 EPSS 13%

    An UPDATE message flood may cause named to exhaust all available memory

    Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the …

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2022-3736 EPSS 48%

    named configured to answer from stale cache may terminate unexpectedly while processing RRSIG queries

    BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2022-3924 EPSS 16%

    named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota

    This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a cor…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2022-2795

    Processing large delegations may severely degrade resolver performance

    By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.

    ISC BIND9 bind9 bind9 Debian Ubuntu Azure Linux Alpine

References

  • report
    https://access.redhat.com/security/cve/CVE-2022-2795
  • report
    https://access.redhat.com/security/cve/CVE-2022-3094
  • report
    https://access.redhat.com/security/cve/CVE-2022-3736
  • report
    https://access.redhat.com/security/cve/CVE-2022-3924
  • report
    https://bugzilla.redhat.com/2128584
  • report
    https://bugzilla.redhat.com/2164032
  • report
    https://bugzilla.redhat.com/2164038
  • report
    https://bugzilla.redhat.com/2164039
  • advisory
    https://errata.almalinux.org/9/ALSA-2023-2261.html