Summary
[32:9.11.13-5]
- Limit number of queries triggered by a request (CVE-2020-8616)
[32:9.11.13-4]
- Fix invalid tsig request (CVE-2020-8617)
Fixed packages 17
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bind | 32:9.11.13-5.el8_2 |
| Oracle Linux · 8 | bind-chroot | 32:9.11.13-5.el8_2 |
| Oracle Linux · 8 | bind-devel | 32:9.11.13-5.el8_2 |
| Oracle Linux · 8 | bind-export-devel | 32:9.11.13-5.el8_2 |
| Oracle Linux · 8 | bind-export-libs | 32:9.11.13-5.el8_2 |
| Oracle Linux · 8 | bind-libs | 32:9.11.13-5.el8_2 |
| Oracle Linux · 8 | bind-libs-lite | 32:9.11.13-5.el8_2 |
| Oracle Linux · 8 | bind-license | 32:9.11.13-5.el8_2 |
| Oracle Linux · 8 | bind-lite-devel | 32:9.11.13-5.el8_2 |
| Oracle Linux · 8 | bind-pkcs11 | 32:9.11.13-5.el8_2 |
| Oracle Linux · 8 | bind-pkcs11-devel | 32:9.11.13-5.el8_2 |
| Oracle Linux · 8 | bind-pkcs11-libs | 32:9.11.13-5.el8_2 |
| Oracle Linux · 8 | bind-pkcs11-utils | 32:9.11.13-5.el8_2 |
| Oracle Linux · 8 | bind-sdb | 32:9.11.13-5.el8_2 |
| Oracle Linux · 8 | bind-sdb-chroot | 32:9.11.13-5.el8_2 |
| Oracle Linux · 8 | bind-utils | 32:9.11.13-5.el8_2 |
| Oracle Linux · 8 | python3-bind | 32:9.11.13-5.el8_2 |
Vulnerabilities 2
-
High 8.6CVE-2020-8616 EPSS 11%
BIND does not sufficiently limit the number of fetches performed when processing referrals
A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches i…
-
High 7.5
A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key…