Summary
[32:9.16.23-0.7.1]
- Fix possible serve-stale related crash (CVE-2022-3080)
- Fix memory leak in ECDSA verify processing (CVE-2022-38177)
- Fix memory leak in EdDSA verify processing (CVE-2022-38178)
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bind9.16 | 32:9.16.23-0.7.el8_6.1 |
| Oracle Linux · 8 | bind9.16-chroot | 32:9.16.23-0.7.el8_6.1 |
| Oracle Linux · 8 | bind9.16-devel | 32:9.16.23-0.7.el8_6.1 |
| Oracle Linux · 8 | bind9.16-dnssec-utils | 32:9.16.23-0.7.el8_6.1 |
| Oracle Linux · 8 | bind9.16-doc | 32:9.16.23-0.7.el8_6.1 |
| Oracle Linux · 8 | bind9.16-libs | 32:9.16.23-0.7.el8_6.1 |
| Oracle Linux · 8 | bind9.16-license | 32:9.16.23-0.7.el8_6.1 |
| Oracle Linux · 8 | bind9.16-utils | 32:9.16.23-0.7.el8_6.1 |
| Oracle Linux · 8 | python3-bind9.16 | 32:9.16.23-0.7.el8_6.1 |
Vulnerabilities 3
-
High 7.5
BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly
By sending specific queries to the resolver, an attacker can cause named to crash.
-
High 7.5
Memory leak in ECDSA DNSSEC verification code
By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
-
High 7.5
Memory leaks in EdDSA DNSSEC verification code
By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.