Summary
[32:9.11.36-11]
- Prevent exahustion of memory from control channel (CVE-2023-3341)
[32:9.11.36-10]
- Prevent the cache going over the configured limit (CVE-2023-2828)
[32:9.11.36-9]
- Prevent flooding with UPDATE requests (CVE-2022-3094)
- include upstream test for that change
Fixed packages 17
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bind | 32:9.11.36-11.el8_9 |
| Oracle Linux · 8 | bind-chroot | 32:9.11.36-11.el8_9 |
| Oracle Linux · 8 | bind-devel | 32:9.11.36-11.el8_9 |
| Oracle Linux · 8 | bind-export-devel | 32:9.11.36-11.el8_9 |
| Oracle Linux · 8 | bind-export-libs | 32:9.11.36-11.el8_9 |
| Oracle Linux · 8 | bind-libs | 32:9.11.36-11.el8_9 |
| Oracle Linux · 8 | bind-libs-lite | 32:9.11.36-11.el8_9 |
| Oracle Linux · 8 | bind-license | 32:9.11.36-11.el8_9 |
| Oracle Linux · 8 | bind-lite-devel | 32:9.11.36-11.el8_9 |
| Oracle Linux · 8 | bind-pkcs11 | 32:9.11.36-11.el8_9 |
| Oracle Linux · 8 | bind-pkcs11-devel | 32:9.11.36-11.el8_9 |
| Oracle Linux · 8 | bind-pkcs11-libs | 32:9.11.36-11.el8_9 |
| Oracle Linux · 8 | bind-pkcs11-utils | 32:9.11.36-11.el8_9 |
| Oracle Linux · 8 | bind-sdb | 32:9.11.36-11.el8_9 |
| Oracle Linux · 8 | bind-sdb-chroot | 32:9.11.36-11.el8_9 |
| Oracle Linux · 8 | bind-utils | 32:9.11.36-11.el8_9 |
| Oracle Linux · 8 | python3-bind | 32:9.11.36-11.el8_9 |
Vulnerabilities 1
-
High 7.5CVE-2022-3094 EPSS 13%
An UPDATE message flood may cause named to exhaust all available memory
Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the …