Skip to content
OpenAdvisories
High DLA-2227-1 2 CVEs

bind9 - security update

Published May 30, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 8 bind9 1:9.9.5.dfsg-9+deb8u19

Vulnerabilities 2

  • High 8.6
    CVE-2020-8616 EPSS 11%

    BIND does not sufficiently limit the number of fetches performed when processing referrals

    A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches i…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine
  • High 7.5
    CVE-2020-8617 Public exploit EPSS 93%

    A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c

    Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine