Skip to content
OpenAdvisories
High RHSA-2024:2720 6 CVEs

Red Hat Security Advisory: bind and dhcp security update

Published Sep 16, 2024 · Updated Sep 2, 2026

Ecosystem: Red Hat

Fixed packages 50

ReleasePackageFixed in
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-chroot 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-debuginfo 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-debugsource 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-devel 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-export-libs-debuginfo 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-libs 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-libs-debuginfo 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-libs-lite 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-libs-lite-debuginfo 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-license 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-lite-devel 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-pkcs11 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-pkcs11-debuginfo 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-pkcs11-devel 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-pkcs11-libs 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-pkcs11-libs-debuginfo 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-pkcs11-utils 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-pkcs11-utils-debuginfo 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-sdb 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-sdb-chroot 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-sdb-debuginfo 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-utils 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream bind-utils-debuginfo 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream python3-bind 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos bind 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos bind-debuginfo 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos bind-debugsource 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos bind-export-devel 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos bind-export-libs 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos bind-export-libs-debuginfo 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos bind-libs-debuginfo 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos bind-libs-lite-debuginfo 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos bind-pkcs11-debuginfo 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos bind-pkcs11-libs-debuginfo 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos bind-pkcs11-utils-debuginfo 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos bind-sdb-debuginfo 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos bind-utils-debuginfo 32:9.11.36-3.el8_6.7
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos dhcp 12:4.3.6-47.el8_6.2
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos dhcp-client 12:4.3.6-47.el8_6.2
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos dhcp-client-debuginfo 12:4.3.6-47.el8_6.2
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos dhcp-common 12:4.3.6-47.el8_6.2
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos dhcp-debuginfo 12:4.3.6-47.el8_6.2
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos dhcp-debugsource 12:4.3.6-47.el8_6.2
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos dhcp-libs 12:4.3.6-47.el8_6.2
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos dhcp-libs-debuginfo 12:4.3.6-47.el8_6.2
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos dhcp-relay 12:4.3.6-47.el8_6.2
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos dhcp-relay-debuginfo 12:4.3.6-47.el8_6.2
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos dhcp-server 12:4.3.6-47.el8_6.2
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::baseos dhcp-server-debuginfo 12:4.3.6-47.el8_6.2

Vulnerabilities 6

  • High 7.5
    CVE-2022-3094 EPSS 13%

    An UPDATE message flood may cause named to exhaust all available memory

    Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the …

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2023-4408

    Parsing large DNS messages may cause excessive CPU load

    The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by ex…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2023-50387 Public exploit EPSS 100%

    Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to …

    bind9 bind9 bind unbound Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2023-50868 Public exploit EPSS 74%

    The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote att…

    bind9 bind9 bind unbound Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.8
    CVE-2021-25220

    DNS forwarders - cache poisoning vulnerability

    BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to…

    ISC BIND bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2022-2795

    Processing large delegations may severely degrade resolver performance

    By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.

    ISC BIND9 bind9 bind9 Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2064512
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2128584
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2164032
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2263896
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2263914
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2263917
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2720.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-25220
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-25220
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-25220
  • article
    https://kb.isc.org/docs/CVE-2021-25220
  • report
    https://access.redhat.com/security/cve/CVE-2022-2795
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-2795
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-2795
  • article
    https://kb.isc.org/docs/cve-2022-2795
  • report
    https://access.redhat.com/security/cve/CVE-2022-3094
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-3094
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-3094
  • article
    https://kb.isc.org/docs/cve-2022-3094
  • report
    https://access.redhat.com/security/cve/CVE-2023-4408
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-4408
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-4408
  • article
    https://kb.isc.org/docs/cve-2023-4408
  • report
    https://access.redhat.com/security/cve/CVE-2023-50387
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-50387
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-50387
  • article
    https://blog.powerdns.com/2024/02/13/powerdns-recursor-4-8-6-4-9-3-5-0-2-released
  • article
    https://kb.isc.org/docs/cve-2023-50387
  • article
    https://www.knot-resolver.cz/2024-02-13-knot-resolver-5.7.1.html
  • report
    https://access.redhat.com/security/cve/CVE-2023-50868
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-50868
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-50868
  • article
    https://kb.isc.org/docs/cve-2023-50868