Summary
[32:9.18.29-4.2]
- Fix upstream reported regression in recent CVE fix (CVE-2025-8677)
- Add upstream created test to this regression
[32:9.18.29-4.1]
- Refuse malformed DNSKEY records (CVE-2025-8677)
- Address various spoofing attacks (CVE-2025-40778)
- Prevent cache poisoning due to weak PRNG (CVE-2025-40780)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | bind9.18 | 32:9.18.29-4.el9_6.2 |
| Oracle Linux · 9 | bind9.18-chroot | 32:9.18.29-4.el9_6.2 |
| Oracle Linux · 9 | bind9.18-devel | 32:9.18.29-4.el9_6.2 |
| Oracle Linux · 9 | bind9.18-dnssec-utils | 32:9.18.29-4.el9_6.2 |
| Oracle Linux · 9 | bind9.18-doc | 32:9.18.29-4.el9_6.2 |
| Oracle Linux · 9 | bind9.18-libs | 32:9.18.29-4.el9_6.2 |
| Oracle Linux · 9 | bind9.18-utils | 32:9.18.29-4.el9_6.2 |
Vulnerabilities 3
-
High 8.6CVE-2025-40778 Public exploit
Cache poisoning attacks with unsolicited RRs
Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 …
-
High 8.6
Cache poisoning due to weak PRNG
In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.…
-
High 7.5CVE-2025-8677 EPSS 11%
Resource exhaustion via malformed DNSKEY handling
Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-…