rpm package
almalinux/bind-dyndb-ldap
pkg:rpm/almalinux/bind-dyndb-ldap
Vulnerabilities (20)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-59089 | Med | 5.9 | < 11.6-6.module_el8.10.0+3980+d78e8e90 | 11.6-6.module_el8.10.0+3980+d78e8e90 | Nov 12, 2025 | If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's respo | |
| CVE-2025-59088 | Hig | 8.6 | < 11.6-6.module_el8.10.0+3980+d78e8e90 | 11.6-6.module_el8.10.0+3980+d78e8e90 | Nov 12, 2025 | If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could | |
| CVE-2025-7493 | Cri | 9.1 | < 11.6-6.module_el8.10.0+3980+d78e8e90 | 11.6-6.module_el8.10.0+3980+d78e8e90 | Sep 30, 2025 | A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM crede | |
| CVE-2025-4404 | Cri | 9.1 | < 11.6-6.module_el8.10.0+3980+d78e8e90 | 11.6-6.module_el8.10.0+3980+d78e8e90 | Jun 17, 2025 | A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM | |
| CVE-2024-4076 | Hig | 7.5 | < 11.9-10.el9_4.alma.1 | 11.9-10.el9_4.alma.1 | Jul 23, 2024 | Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37 | |
| CVE-2024-1975 | Hig | 7.5 | < 11.9-10.el9_4.alma.1 | 11.9-10.el9_4.alma.1 | Jul 23, 2024 | If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests. This issue affects BIND 9 versions | |
| CVE-2024-1737 | Hig | 7.5 | < 11.9-10.el9_4.alma.1 | 11.9-10.el9_4.alma.1 | Jul 23, 2024 | Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name. This issue affects BIND 9 ver | |
| CVE-2024-3183 | — | < 11.6-5.module_el8.10.0+3844+20e075e5.alma.2 | 11.6-5.module_el8.10.0+3844+20e075e5.alma.2 | Jun 12, 2024 | A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session, which protects it from brute force attacks. However, the ticket it contains is encrypted using the target principal key d | ||
| CVE-2024-2698 | — | < 11.6-5.module_el8.10.0+3844+20e075e5.alma.2 | 11.6-5.module_el8.10.0+3844+20e075e5.alma.2 | Jun 12, 2024 | A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for the check_allowed_to_delegate() function: If th | ||
| CVE-2023-50868 | — | < 11.9-8.el9_3.3.alma.1 | 11.9-8.el9_3.3.alma.1 | Feb 14, 2024 | The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 51 | ||
| CVE-2023-50387 | — | < 11.9-8.el9_3.3.alma.1 | 11.9-8.el9_3.3.alma.1 | Feb 14, 2024 | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with man | ||
| CVE-2023-6516 | — | < 11.9-8.el9_3.3.alma.1 | 11.9-8.el9_3.3.alma.1 | Feb 13, 2024 | To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first alloc | ||
| CVE-2023-5679 | — | < 11.9-8.el9_3.3.alma.1 | 11.9-8.el9_3.3.alma.1 | Feb 13, 2024 | A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9 | ||
| CVE-2023-5517 | — | < 11.9-8.el9_3.3.alma.1 | 11.9-8.el9_3.3.alma.1 | Feb 13, 2024 | A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect ;` is configured, and - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response | ||
| CVE-2023-4408 | — | < 11.9-8.el9_3.3.alma.1 | 11.9-8.el9_3.3.alma.1 | Feb 13, 2024 | The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. T | ||
| CVE-2023-5455 | — | < 11.6-4.module_el8.6.0+3339+9b5fdd22 | 11.6-4.module_el8.6.0+3339+9b5fdd22 | Jan 10, 2024 | A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system int | ||
| CVE-2020-25719 | — | < 11.6-2.module_el8.5.0+2603+92118e57 | 11.6-2.module_el8.5.0+2603+92118e57 | Feb 18, 2022 | A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found withi | ||
| CVE-2021-3480 | — | < 11.6-2.module_el8.5.0+2603+92118e57 | 11.6-2.module_el8.5.0+2603+92118e57 | May 20, 2021 | A flaw was found in slapi-nis in versions before 0.56.7. A NULL pointer dereference during the parsing of the Binding DN could allow an unauthenticated attacker to crash the 389-ds-base directory server. The highest threat from this vulnerability is to system availability. | ||
| CVE-2020-17049 | — | < 11.6-4.module_el8.6.0+3339+9b5fdd22 | 11.6-4.module_el8.6.0+3339+9b5fdd22 | Nov 11, 2020 | A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tam | ||
| CVE-2020-11023 | — | KEV | < 11.6-2.module_el8.5.0+2603+92118e57 | 11.6-2.module_el8.5.0+2603+92118e57 | Apr 29, 2020 | In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This pro |
- affected < 11.6-6.module_el8.10.0+3980+d78e8e90fixed 11.6-6.module_el8.10.0+3980+d78e8e90
If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's respo
- affected < 11.6-6.module_el8.10.0+3980+d78e8e90fixed 11.6-6.module_el8.10.0+3980+d78e8e90
If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could
- affected < 11.6-6.module_el8.10.0+3980+d78e8e90fixed 11.6-6.module_el8.10.0+3980+d78e8e90
A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM crede
- affected < 11.6-6.module_el8.10.0+3980+d78e8e90fixed 11.6-6.module_el8.10.0+3980+d78e8e90
A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM
- affected < 11.9-10.el9_4.alma.1fixed 11.9-10.el9_4.alma.1
Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37
- affected < 11.9-10.el9_4.alma.1fixed 11.9-10.el9_4.alma.1
If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests. This issue affects BIND 9 versions
- affected < 11.9-10.el9_4.alma.1fixed 11.9-10.el9_4.alma.1
Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name. This issue affects BIND 9 ver
- CVE-2024-3183Jun 12, 2024affected < 11.6-5.module_el8.10.0+3844+20e075e5.alma.2fixed 11.6-5.module_el8.10.0+3844+20e075e5.alma.2
A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session, which protects it from brute force attacks. However, the ticket it contains is encrypted using the target principal key d
- CVE-2024-2698Jun 12, 2024affected < 11.6-5.module_el8.10.0+3844+20e075e5.alma.2fixed 11.6-5.module_el8.10.0+3844+20e075e5.alma.2
A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for the check_allowed_to_delegate() function: If th
- CVE-2023-50868Feb 14, 2024affected < 11.9-8.el9_3.3.alma.1fixed 11.9-8.el9_3.3.alma.1
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 51
- CVE-2023-50387Feb 14, 2024affected < 11.9-8.el9_3.3.alma.1fixed 11.9-8.el9_3.3.alma.1
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with man
- CVE-2023-6516Feb 13, 2024affected < 11.9-8.el9_3.3.alma.1fixed 11.9-8.el9_3.3.alma.1
To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first alloc
- CVE-2023-5679Feb 13, 2024affected < 11.9-8.el9_3.3.alma.1fixed 11.9-8.el9_3.3.alma.1
A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9
- CVE-2023-5517Feb 13, 2024affected < 11.9-8.el9_3.3.alma.1fixed 11.9-8.el9_3.3.alma.1
A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect ;` is configured, and - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response
- CVE-2023-4408Feb 13, 2024affected < 11.9-8.el9_3.3.alma.1fixed 11.9-8.el9_3.3.alma.1
The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. T
- CVE-2023-5455Jan 10, 2024affected < 11.6-4.module_el8.6.0+3339+9b5fdd22fixed 11.6-4.module_el8.6.0+3339+9b5fdd22
A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system int
- CVE-2020-25719Feb 18, 2022affected < 11.6-2.module_el8.5.0+2603+92118e57fixed 11.6-2.module_el8.5.0+2603+92118e57
A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found withi
- CVE-2021-3480May 20, 2021affected < 11.6-2.module_el8.5.0+2603+92118e57fixed 11.6-2.module_el8.5.0+2603+92118e57
A flaw was found in slapi-nis in versions before 0.56.7. A NULL pointer dereference during the parsing of the Binding DN could allow an unauthenticated attacker to crash the 389-ds-base directory server. The highest threat from this vulnerability is to system availability.
- CVE-2020-17049Nov 11, 2020affected < 11.6-4.module_el8.6.0+3339+9b5fdd22fixed 11.6-4.module_el8.6.0+3339+9b5fdd22
A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tam
- affected < 11.6-2.module_el8.5.0+2603+92118e57fixed 11.6-2.module_el8.5.0+2603+92118e57
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This pro