Skip to content
OpenAdvisories
High ELSA-2024-5390 3 CVEs

Important: bind9.16 security update (Oracle Linux 8)

Published Aug 14, 2024 · Updated Aug 14, 2024

Ecosystem: Oracle Linux

Summary

[32:9.16.23-0.22]
- Minor fix of reclimit test backport (CVE-2024-1737)

[32:9.16.23-0.21]
- Backport addition of max-records-per-type and max-records-per-type options
(CVE-2024-1737)

[32:9.16.23-0.20]
- Resolve CVE-2024-1975
- Resolve CVE-2024-1737
- Resolve CVE-2024-4076
- Add ability to change runtime limits for max types and records per name

[32:9.16.23-0.19]
- Add few more explicit conflicts with bind subpackages (RHEL-2208)

[32:9.16.23-0.18]
- Prevent crashing at masterformat system test (CVE-2023-6516)

[32:9.16.23-0.17]
- Prevent increased CPU load on large DNS messages (CVE-2023-4408)
- Prevent assertion failure when nxdomain-redirect is used with
RFC 1918 reverse zones (CVE-2023-5517)
- Prevent assertion failure if DNS64 and serve-stale is used (CVE-2023-5679)
- Specific recursive query patterns may lead to an out-of-memory
condition (CVE-2023-6516)
- Prevent increased CPU consumption in DNSSEC validator (CVE-2023-50387
CVE-2023-50868)
- Import tests for large DNS messages fix
- Add downstream change complementing CVE-2023-50387

Fixed packages 9

ReleasePackageFixed in
Oracle Linux · 8 bind9.16 32:9.16.23-0.22.el8_10
Oracle Linux · 8 bind9.16-chroot 32:9.16.23-0.22.el8_10
Oracle Linux · 8 bind9.16-devel 32:9.16.23-0.22.el8_10
Oracle Linux · 8 bind9.16-dnssec-utils 32:9.16.23-0.22.el8_10
Oracle Linux · 8 bind9.16-doc 32:9.16.23-0.22.el8_10
Oracle Linux · 8 bind9.16-libs 32:9.16.23-0.22.el8_10
Oracle Linux · 8 bind9.16-license 32:9.16.23-0.22.el8_10
Oracle Linux · 8 bind9.16-utils 32:9.16.23-0.22.el8_10
Oracle Linux · 8 python3-bind9.16 32:9.16.23-0.22.el8_10

Vulnerabilities 3

  • High 7.5
    CVE-2024-1737

    BIND's database will be slow if a very large number of RRs exist at the same name

    Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name. This iss…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2024-1975

    SIG(0) can be used to exhaust CPU resources

    If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests. This issue aff…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2024-4076

    Assertion failure when serving both stale cache data and authoritative zone content

    Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi