Summary
[32:9.16.23-0.14]
- Handle subtle difference between upstream and rhel (CVE-2022-3094)
[32:9.16.23-0.13]
- Prevent flooding with UPDATE requests (CVE-2022-3094)
- Handle RRSIG queries when server-stale is active (CVE-2022-3736)
- Fix crash when soft-quota is reached and serve-stale is active (CVE-2022-3924)
[32:9.16.23-0.12]
- Include bind9.16-dnssec-utils in public repository (#2115322)
[32:9.16.23-0.11]
- Bound the amount of work performed for delegations (CVE-2022-2795)
[32:9.16.23-0.10]
- Fix possible serve-stale related crash (CVE-2022-3080)
- Fix memory leak in ECDSA verify processing (CVE-2022-38177)
- Fix memory leak in EdDSA verify processing (CVE-2022-38178)
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bind9.16 | 32:9.16.23-0.14.el8 |
| Oracle Linux · 8 | bind9.16-chroot | 32:9.16.23-0.14.el8 |
| Oracle Linux · 8 | bind9.16-devel | 32:9.16.23-0.14.el8 |
| Oracle Linux · 8 | bind9.16-dnssec-utils | 32:9.16.23-0.14.el8 |
| Oracle Linux · 8 | bind9.16-doc | 32:9.16.23-0.14.el8 |
| Oracle Linux · 8 | bind9.16-libs | 32:9.16.23-0.14.el8 |
| Oracle Linux · 8 | bind9.16-license | 32:9.16.23-0.14.el8 |
| Oracle Linux · 8 | bind9.16-utils | 32:9.16.23-0.14.el8 |
| Oracle Linux · 8 | python3-bind9.16 | 32:9.16.23-0.14.el8 |
Vulnerabilities 4
-
High 7.5CVE-2022-3094 EPSS 13%
An UPDATE message flood may cause named to exhaust all available memory
Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the …
-
High 7.5CVE-2022-3736 EPSS 48%
named configured to answer from stale cache may terminate unexpectedly while processing RRSIG queries
BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9…
-
High 7.5CVE-2022-3924 EPSS 16%
named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota
This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a cor…
-
Medium 5.3
Processing large delegations may severely degrade resolver performance
By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.