rpm package
almalinux/bind9.16-devel
pkg:rpm/almalinux/bind9.16-devel
Vulnerabilities (32)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-4408 | Hig | 7.5 | < 32:9.16.23-0.16.el8_9.2.alma.1 | 32:9.16.23-0.16.el8_9.2.alma.1 | Feb 13, 2024 | The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. T | |
| CVE-2023-3341 | Hig | 7.5 | < 32:9.16.23-0.14.el8_8.2.alma.1 | 32:9.16.23-0.14.el8_8.2.alma.1 | Sep 20, 2023 | The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of avai | |
| CVE-2023-2828 | Hig | 7.5 | < 32:9.16.23-0.14.el8_8.1.alma | 32:9.16.23-0.14.el8_8.1.alma | Jun 21, 2023 | Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size` statement in the con | |
| CVE-2022-3924 | Hig | 7.5 | < 32:9.16.23-0.14.el8 | 32:9.16.23-0.14.el8 | Jan 26, 2023 | This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a corresponding increase | |
| CVE-2022-3736 | Hig | 7.5 | < 32:9.16.23-0.14.el8 | 32:9.16.23-0.14.el8 | Jan 26, 2023 | BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 throug | |
| CVE-2022-3094 | Hig | 7.5 | < 32:9.16.23-0.14.el8 | 32:9.16.23-0.14.el8 | Jan 26, 2023 | Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the checking of access p | |
| CVE-2022-3080 | Hig | 7.5 | < 32:9.16.23-0.7.el8_6.1 | 32:9.16.23-0.7.el8_6.1 | Sep 21, 2022 | By sending specific queries to the resolver, an attacker can cause named to crash. | |
| CVE-2022-38178 | Hig | 7.5 | < 32:9.16.23-0.7.el8_6.1 | 32:9.16.23-0.7.el8_6.1 | Sep 21, 2022 | By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources. | |
| CVE-2022-38177 | Hig | 7.5 | < 32:9.16.23-0.7.el8_6.1 | 32:9.16.23-0.7.el8_6.1 | Sep 21, 2022 | By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources. | |
| CVE-2022-2795 | Med | 5.3 | < 32:9.16.23-0.14.el8 | 32:9.16.23-0.14.el8 | Sep 21, 2022 | By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service. | |
| CVE-2021-25220 | Med | 6.8 | < 32:9.16.23-0.9.el8.1 | 32:9.16.23-0.9.el8.1 | Mar 23, 2022 | BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have | |
| CVE-2022-0396 | Med | 5.3 | < 32:9.16.23-0.9.el8.1 | 32:9.16.23-0.9.el8.1 | Mar 23, 2022 | BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has termina |
- affected < 32:9.16.23-0.16.el8_9.2.alma.1fixed 32:9.16.23-0.16.el8_9.2.alma.1
The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. T
- affected < 32:9.16.23-0.14.el8_8.2.alma.1fixed 32:9.16.23-0.14.el8_8.2.alma.1
The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of avai
- affected < 32:9.16.23-0.14.el8_8.1.almafixed 32:9.16.23-0.14.el8_8.1.alma
Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size` statement in the con
- affected < 32:9.16.23-0.14.el8fixed 32:9.16.23-0.14.el8
This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a corresponding increase
- affected < 32:9.16.23-0.14.el8fixed 32:9.16.23-0.14.el8
BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 throug
- affected < 32:9.16.23-0.14.el8fixed 32:9.16.23-0.14.el8
Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the checking of access p
- affected < 32:9.16.23-0.7.el8_6.1fixed 32:9.16.23-0.7.el8_6.1
By sending specific queries to the resolver, an attacker can cause named to crash.
- affected < 32:9.16.23-0.7.el8_6.1fixed 32:9.16.23-0.7.el8_6.1
By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
- affected < 32:9.16.23-0.7.el8_6.1fixed 32:9.16.23-0.7.el8_6.1
By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
- affected < 32:9.16.23-0.14.el8fixed 32:9.16.23-0.14.el8
By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.
- affected < 32:9.16.23-0.9.el8.1fixed 32:9.16.23-0.9.el8.1
BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have
- affected < 32:9.16.23-0.9.el8.1fixed 32:9.16.23-0.9.el8.1
BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has termina
Page 2 of 2