Skip to content
OpenAdvisories
High DSA-4689-1 2 CVEs

bind9 - security update

Published May 19, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 10 bind9 1:9.11.5.P4+dfsg-5.1+deb10u1
Debian · 9 bind9 1:9.10.3.dfsg.P4-12.3+deb9u6

Vulnerabilities 2

  • High 8.6
    CVE-2020-8616 EPSS 11%

    BIND does not sufficiently limit the number of fetches performed when processing referrals

    A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches i…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine
  • High 7.5
    CVE-2020-8617 Public exploit EPSS 93%

    A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c

    Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine