Skip to content
OpenAdvisories
Medium ELSA-2020-4500 4 CVEs

Moderate: bind security, bug fix, and enhancement update (Oracle Linux 8)

Published Nov 10, 2020 · Updated Nov 10, 2020

Ecosystem: Oracle Linux

Summary

[32:9.11.20-5]
- Fix tsig-request verify (CVE-2020-8622)
- Prevent PKCS11 daemon crash on crafted packet (CVE-2020-8623)
- Correct update-policy type subdomain to match documentation (CVE-2020-8624)
- Include available test

[32:9.11.20-4]
- Prevent crash on dstlib initialization failure (#1859454)

[32:9.11.20-3]
- Add remaining require to bind package (#1633169)

[32:9.11.20-2]
- Add manual page for dnssec-importkey-pkcs11 (#1666785)
- Add versioned depends to all library subpackages

[32:9.11.20-1]
- Update to 9.11.20

[32:9.11.19-2]
- Remove old KSK 19036 from remaining trusted-key.key

[32:9.11.19-1]
- Update to 9.11.19 (CVE-2020-8616, CVE-2020-8617)

[32:9.11.18-1]
- Update to 9.11.18

[32:9.11.17-1]
- Update to 9.11.17

[32:9.11.14-1]
- Update to 9.11.14
- Remove libmaxminddb-devel from devel package dependencies

Fixed packages 17

ReleasePackageFixed in
Oracle Linux · 8 bind 32:9.11.20-5.el8
Oracle Linux · 8 bind-chroot 32:9.11.20-5.el8
Oracle Linux · 8 bind-devel 32:9.11.20-5.el8
Oracle Linux · 8 bind-export-devel 32:9.11.20-5.el8
Oracle Linux · 8 bind-export-libs 32:9.11.20-5.el8
Oracle Linux · 8 bind-libs 32:9.11.20-5.el8
Oracle Linux · 8 bind-libs-lite 32:9.11.20-5.el8
Oracle Linux · 8 bind-license 32:9.11.20-5.el8
Oracle Linux · 8 bind-lite-devel 32:9.11.20-5.el8
Oracle Linux · 8 bind-pkcs11 32:9.11.20-5.el8
Oracle Linux · 8 bind-pkcs11-devel 32:9.11.20-5.el8
Oracle Linux · 8 bind-pkcs11-libs 32:9.11.20-5.el8
Oracle Linux · 8 bind-pkcs11-utils 32:9.11.20-5.el8
Oracle Linux · 8 bind-sdb 32:9.11.20-5.el8
Oracle Linux · 8 bind-sdb-chroot 32:9.11.20-5.el8
Oracle Linux · 8 bind-utils 32:9.11.20-5.el8
Oracle Linux · 8 python3-bind 32:9.11.20-5.el8

Vulnerabilities 4

  • High 7.5
    CVE-2020-8623

    A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c

    In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulner…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2020-8622

    A truncated TSIG response can lead to an assertion failure

    In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, co…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine
  • Medium 4.9
    CVE-2020-8619

    A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer

    In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains …

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine
  • Medium 4.3
    CVE-2020-8624

    update-policy rules of type "subdomain" are enforced incorrectly

    In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a sp…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine