Skip to content
OpenAdvisories
Medium ELSA-2020-1061 3 CVEs

Moderate: bind security and bug fix update (Oracle Linux 7)

Published Apr 6, 2020 · Updated Apr 6, 2020

Ecosystem: Oracle Linux

Summary

[32:9.11.4-16.P2]
- Finish dig query when name is too long (#1743572)

[32:9.11.4-15.P2]
- Stop listening on IPv6 by default (#1753259)

[32:9.11.4-14.P2]
- Limit number of queries per TCP connection (CVE-2019-6477)

[32:9.11.4-13.P2]
- Revert not searching names with dot (#1743572)

[32:9.11.4-12.P2]
- Fix mkeys test validating CVE-2018-5745 fix

[32:9.11.4-11.P2]
- Use monotonic time in export library (#1093803)

[32:9.11.4-10.P2]
- Fix CVE-2018-5745
- Fix CVE-2019-6465

Fixed packages 16

ReleasePackageFixed in
Oracle Linux · 7 bind 32:9.11.4-16.P2.el7
Oracle Linux · 7 bind-chroot 32:9.11.4-16.P2.el7
Oracle Linux · 7 bind-devel 32:9.11.4-16.P2.el7
Oracle Linux · 7 bind-export-devel 32:9.11.4-16.P2.el7
Oracle Linux · 7 bind-export-libs 32:9.11.4-16.P2.el7
Oracle Linux · 7 bind-libs 32:9.11.4-16.P2.el7
Oracle Linux · 7 bind-libs-lite 32:9.11.4-16.P2.el7
Oracle Linux · 7 bind-license 32:9.11.4-16.P2.el7
Oracle Linux · 7 bind-lite-devel 32:9.11.4-16.P2.el7
Oracle Linux · 7 bind-pkcs11 32:9.11.4-16.P2.el7
Oracle Linux · 7 bind-pkcs11-devel 32:9.11.4-16.P2.el7
Oracle Linux · 7 bind-pkcs11-libs 32:9.11.4-16.P2.el7
Oracle Linux · 7 bind-pkcs11-utils 32:9.11.4-16.P2.el7
Oracle Linux · 7 bind-sdb 32:9.11.4-16.P2.el7
Oracle Linux · 7 bind-sdb-chroot 32:9.11.4-16.P2.el7
Oracle Linux · 7 bind-utils 32:9.11.4-16.P2.el7

Vulnerabilities 3

  • High 7.5
    CVE-2019-6477

    TCP-pipelined queries can bypass tcp-clients limit

    With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than t…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2019-6465

    Zone transfer controls for writable DLZ zones were not effective

    Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Alpine
  • Medium 4.9
    CVE-2018-5745

    An assertion failure can occur if a trust anchor rolls over to an unsupported key algorithm when using managed-keys

    "managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys feature it is possible for a BIND server which uses m…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Alpine