Skip to content
OpenAdvisories
High RHSA-2024:1648 6 CVEs

Red Hat Security Advisory: bind9.16 security update

Published Sep 16, 2024 · Updated Aug 7, 2026

Ecosystem: Red Hat

Fixed packages 20

ReleasePackageFixed in
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream bind9.16 32:9.16.23-0.14.el8_8.4
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream bind9.16-chroot 32:9.16.23-0.14.el8_8.4
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream bind9.16-debuginfo 32:9.16.23-0.14.el8_8.4
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream bind9.16-debugsource 32:9.16.23-0.14.el8_8.4
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream bind9.16-dnssec-utils 32:9.16.23-0.14.el8_8.4
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream bind9.16-dnssec-utils-debuginfo 32:9.16.23-0.14.el8_8.4
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream bind9.16-libs 32:9.16.23-0.14.el8_8.4
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream bind9.16-libs-debuginfo 32:9.16.23-0.14.el8_8.4
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream bind9.16-license 32:9.16.23-0.14.el8_8.4
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream bind9.16-utils 32:9.16.23-0.14.el8_8.4
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream bind9.16-utils-debuginfo 32:9.16.23-0.14.el8_8.4
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream python3-bind9.16 32:9.16.23-0.14.el8_8.4
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb bind9.16-debuginfo 32:9.16.23-0.14.el8_8.4
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb bind9.16-debugsource 32:9.16.23-0.14.el8_8.4
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb bind9.16-devel 32:9.16.23-0.14.el8_8.4
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb bind9.16-dnssec-utils-debuginfo 32:9.16.23-0.14.el8_8.4
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb bind9.16-doc 32:9.16.23-0.14.el8_8.4
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb bind9.16-libs 32:9.16.23-0.14.el8_8.4
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb bind9.16-libs-debuginfo 32:9.16.23-0.14.el8_8.4
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb bind9.16-utils-debuginfo 32:9.16.23-0.14.el8_8.4

Vulnerabilities 6

  • High 7.5
    CVE-2023-4408

    Parsing large DNS messages may cause excessive CPU load

    The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by ex…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2023-50387 Public exploit EPSS 100%

    Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to …

    bind9 bind9 bind unbound Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2023-50868 Public exploit EPSS 74%

    The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote att…

    bind9 bind9 bind unbound Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2023-5517

    Querying RFC 1918 reverse zones may cause an assertion failure when "nxdomain-redirect" is enabled

    A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect <domain>;` is configured, and - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative N…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2023-5679

    Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution

    A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2023-6516

    Specific recursive query patterns may lead to an out-of-memory condition

    To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be clea…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2263896
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2263897
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2263909
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2263911
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2263914
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2263917
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1648.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-4408
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-4408
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-4408
  • article
    https://kb.isc.org/docs/cve-2023-4408
  • report
    https://access.redhat.com/security/cve/CVE-2023-5517
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-5517
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-5517
  • article
    https://kb.isc.org/docs/cve-2023-5517
  • report
    https://access.redhat.com/security/cve/CVE-2023-5679
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-5679
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-5679
  • article
    https://kb.isc.org/docs/cve-2023-5679
  • report
    https://access.redhat.com/security/cve/CVE-2023-6516
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-6516
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-6516
  • article
    https://kb.isc.org/docs/cve-2023-6516
  • report
    https://access.redhat.com/security/cve/CVE-2023-50387
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-50387
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-50387
  • article
    https://blog.powerdns.com/2024/02/13/powerdns-recursor-4-8-6-4-9-3-5-0-2-released
  • article
    https://kb.isc.org/docs/cve-2023-50387
  • article
    https://www.knot-resolver.cz/2024-02-13-knot-resolver-5.7.1.html
  • report
    https://access.redhat.com/security/cve/CVE-2023-50868
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-50868
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-50868
  • article
    https://kb.isc.org/docs/cve-2023-50868