Summary
Toshifumi Sakaguchi discovered that Bind incorrectly handled many records
in the additional section. A remote attacker could possibly use this issue
to cause Bind to consume CPU resources, leading to a denial of service.
(CVE-2024-11187)
Jean-François Billaud discovered that the Bind DNS-over-HTTPS
implementation incorrectly handled a heavy query load. A remote attacker
could possibly use this issue to cause Bind to consume resources, leading
to a denial of service. (CVE-2024-12705)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | bind9 | 1:9.18.30-0ubuntu0.20.04.2 |
| Ubuntu · 22.04 LTS 22.04:LTS | bind9 | 1:9.18.30-0ubuntu0.22.04.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | bind9 | 1:9.18.30-0ubuntu0.24.04.2 |
Vulnerabilities 2
-
High 7.5CVE-2024-11187 EPSS 16%
Many records in the additional section cause CPU exhaustion
It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to…
-
High 7.5CVE-2024-12705 EPSS 19%
DNS-over-HTTPS implementation suffers from multiple issues under heavy query load
Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. This issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11…