Summary
[32:9.16.23-1.1]
- Fix possible serve-stale related crash (CVE-2022-3080)
- Fix memory leak in ECDSA verify processing (CVE-2022-38177)
- Fix memory leak in EdDSA verify processing (CVE-2022-38178)
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | bind | 32:9.16.23-1.el9_0.1 |
| Oracle Linux · 9 | bind-chroot | 32:9.16.23-1.el9_0.1 |
| Oracle Linux · 9 | bind-devel | 32:9.16.23-1.el9_0.1 |
| Oracle Linux · 9 | bind-dnssec-doc | 32:9.16.23-1.el9_0.1 |
| Oracle Linux · 9 | bind-dnssec-utils | 32:9.16.23-1.el9_0.1 |
| Oracle Linux · 9 | bind-libs | 32:9.16.23-1.el9_0.1 |
| Oracle Linux · 9 | bind-license | 32:9.16.23-1.el9_0.1 |
| Oracle Linux · 9 | bind-utils | 32:9.16.23-1.el9_0.1 |
| Oracle Linux · 9 | python3-bind | 32:9.16.23-1.el9_0.1 |
Vulnerabilities 3
-
High 7.5
BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly
By sending specific queries to the resolver, an attacker can cause named to crash.
-
High 7.5
Memory leak in ECDSA DNSSEC verification code
By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
-
High 7.5
Memory leaks in EdDSA DNSSEC verification code
By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.