ELSA-2024-3271 — Important: bind and dhcp security update (Oracle Linux 8)

Summary

bind
[32:9.11.36-14]
- Speed up parsing of DNS messages with many different names (CVE-2023-4408)
- Prevent increased CPU consumption in DNSSEC validator (CVE-2023-50387 CVE-2023-50868)
- Do not use header_prev in expire_lru_headers

dhcp
[4.3.6]
- Change bug tracker path

[12:4.3.6-50]
- Rebuild because of bind ABI changes related to CVE-2023-50387

Fixed packages 22

Release	Package	Fixed in
Oracle Linux · 8	bind	32:9.11.36-14.el8_10
Oracle Linux · 8	bind-chroot	32:9.11.36-14.el8_10
Oracle Linux · 8	bind-devel	32:9.11.36-14.el8_10
Oracle Linux · 8	bind-export-devel	32:9.11.36-14.el8_10
Oracle Linux · 8	bind-export-libs	32:9.11.36-14.el8_10
Oracle Linux · 8	bind-libs	32:9.11.36-14.el8_10
Oracle Linux · 8	bind-libs-lite	32:9.11.36-14.el8_10
Oracle Linux · 8	bind-license	32:9.11.36-14.el8_10
Oracle Linux · 8	bind-lite-devel	32:9.11.36-14.el8_10
Oracle Linux · 8	bind-pkcs11	32:9.11.36-14.el8_10
Oracle Linux · 8	bind-pkcs11-devel	32:9.11.36-14.el8_10
Oracle Linux · 8	bind-pkcs11-libs	32:9.11.36-14.el8_10
Oracle Linux · 8	bind-pkcs11-utils	32:9.11.36-14.el8_10
Oracle Linux · 8	bind-sdb	32:9.11.36-14.el8_10
Oracle Linux · 8	bind-sdb-chroot	32:9.11.36-14.el8_10
Oracle Linux · 8	bind-utils	32:9.11.36-14.el8_10
Oracle Linux · 8	dhcp-client	12:4.3.6-50.el8_10
Oracle Linux · 8	dhcp-common	12:4.3.6-50.el8_10
Oracle Linux · 8	dhcp-libs	12:4.3.6-50.el8_10
Oracle Linux · 8	dhcp-relay	12:4.3.6-50.el8_10
Oracle Linux · 8	dhcp-server	12:4.3.6-50.el8_10
Oracle Linux · 8	python3-bind	32:9.11.36-14.el8_10

Vulnerabilities 3

High 7.5

CVE-2023-4408

Parsing large DNS messages may cause excessive CPU load

The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by ex…

ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi

Feb 13, 2024
High 7.5

CVE-2023-50387 Public exploit EPSS 100%

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to …

bind9 bind9 bind unbound Debian Ubuntu Azure Linux Alpine Wolfi

Feb 14, 2024
High 7.5

CVE-2023-50868 Public exploit EPSS 74%

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote att…

bind9 bind9 bind unbound Debian Ubuntu Azure Linux Alpine Wolfi

Feb 14, 2024

Important: bind and dhcp security update (Oracle Linux 8)

Summary

Fixed packages 22

Vulnerabilities 3

Parsing large DNS messages may cause excessive CPU load

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to …

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote att…