Skip to content
OpenAdvisories
High SUSE-RU-2020:2915-1 3 CVEs

Recommended update for bind

Published Oct 13, 2020 · Updated Feb 4, 2026

Ecosystem: SUSE

Summary

This update for bind fixes the following issues:

Bind was updated to version 9.11.22

Note:

- bind is now more strict in regards to DNSSEC. If queries are not working,
check for DNSSEC issues. For instance, if bind is used in a namserver
forwarder chain, the forwarding DNS servers must support DNSSEC.

This upgrade also fixes the following security issues:

* 5481. [security] 'update-policy' rules of type 'subdomain' were
incorrectly treated as 'zonesub' rules, which allowed
keys used in 'subdomain' rules to update names outside
of the specified subdomains. The problem was fixed by
making sure 'subdomain' rules are again processed as
described in the ARM. (CVE-2020-8624 bsc#1175443)
* 5480. [security] When BIND 9 was compiled with native PKCS#11 support, it
was possible to trigger an assertion failure in code
determining the number of bits in the PKCS#11 RSA public
key with a specially crafted packet. (CVE-2020-8623 bsc#1175443)
* 5476. [security] It was possible to trigger an assertion failure when
verifying the response to a TSIG-signed request.
(CVE-2020-8622 bsc#1175443)

- Suppress warning message about missing file. (bsc#1092283, bsc#1127583, bsc#1094236, bsc#1173983)
Added */etc/bind.keys* to *NAMED_CONF_INCLUDE_FILES* in */etc/sysconfig/named*.

Fixed packages 7

ReleasePackageFixed in
SUSE · SLES 12 SP4 Linux Enterprise Server 12 SP4-LTSS bind 9.11.22-3.22.1
SUSE · SLES 12 SP5 Linux Enterprise Server 12 SP5 bind 9.11.22-3.22.1
SUSE · SLES for SAP 12 SP4 Linux Enterprise Server for SAP Applications 12 SP4 bind 9.11.22-3.22.1
SUSE · SLES for SAP 12 SP5 Linux Enterprise Server for SAP Applications 12 SP5 bind 9.11.22-3.22.1
SUSE · SLES 12 SP5 Linux Enterprise Software Development Kit 12 SP5 bind 9.11.22-3.22.1
SUSE · OpenStack Cloud 9 bind 9.11.22-3.22.1
SUSE · OpenStack Cloud Crowbar 9 bind 9.11.22-3.22.1

Vulnerabilities 3

  • High 7.5
    CVE-2020-8623

    A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c

    In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulner…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2020-8622

    A truncated TSIG response can lead to an assertion failure

    In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, co…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine
  • Medium 4.3
    CVE-2020-8624

    update-policy rules of type "subdomain" are enforced incorrectly

    In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a sp…

    ISC BIND9 bind9 bind9 Debian Ubuntu Alpine

References

  • report
    https://bugzilla.suse.com/1092283
  • report
    https://bugzilla.suse.com/1094236
  • report
    https://bugzilla.suse.com/1127583
  • report
    https://bugzilla.suse.com/1173983
  • report
    https://bugzilla.suse.com/1175443
  • web
    https://www.suse.com/security/cve/CVE-2020-8622
  • web
    https://www.suse.com/security/cve/CVE-2020-8623
  • web
    https://www.suse.com/security/cve/CVE-2020-8624