Important: bind and dhcp security update
Summary
ALSA-2024:3271: Important: bind and dhcp security update. Affects bind versions < 32:9.11.36-14.el8_10. Fixed in 32:9.11.36-14.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network.
Vulnerability Detail
Parsing large DNS messages in bind9 may cause excessive CPU load (CVE-2023-4408). Extreme CPU consumption in DNSSEC validator in bind9 (CVE-2023-50387). Preparing an NSEC3 closest encloser proof can exhaust CPU resources in bind9 (CVE-2023-50868).
How To Fix
Minimum fixed version
32:9.11.36-14.el8_10
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
To mitigate the vulnerabilities, it is crucial to update the bind and dhcp packages to version 9.11.36-14.el8_10 or later. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for bind →
FAQ
BIND is an implementation of the Domain Name System (DNS) protocols, providing a DNS server, resolver library, and tools for DNS server verification.
DHCP is a protocol that allows devices on an IP network to obtain their network configuration information, such as IP address and subnet mask.
CVE-2023-4408 is a vulnerability in bind9 that can cause excessive CPU load when parsing large DNS messages.
CVE-2023-50387 is a vulnerability in bind9 that leads to extreme CPU consumption in the DNSSEC validator.
CVE-2023-50868 is a vulnerability in bind9 that can exhaust CPU resources when preparing an NSEC3 closest encloser proof.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
