Moderate: bind security update
Summary
ALSA-2023:7177: Moderate: bind security update. Affects bind versions < 32:9.11.36-11.el8_9. Fixed in 32:9.11.36-11.el8_9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Vulnerability Detail
The BIND software is vulnerable to a Denial of Service (DoS) attack caused by flooding with UPDATE requests. This vulnerability is identified as CVE-2022-3094. An attacker can exploit this vulnerability to overwhelm the BIND server, leading to service disruption and potential impact on DNS resolution.
How To Fix
Minimum fixed version
32:9.11.36-11.el8_9
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update as soon as possible to protect the BIND server from potential attacks.
Conclusion
The BIND software is vulnerable to a Denial of Service (DoS) attack. It is crucial to update the BIND package to the latest version to mitigate this vulnerability and ensure the stability and security of DNS services. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bind →
FAQ
BIND is an implementation of the Domain Name System (DNS) protocols, providing DNS server functionality, resolver library, and related tools.
The vulnerability allows an attacker to flood the BIND server with UPDATE requests, leading to a Denial of Service (DoS) condition and potential disruption of DNS services.
To fix this vulnerability, update the BIND package to version 9.11.36-11.el8_9 or later from the official AlmaLinux repositories.
No, there is no known workaround for this vulnerability. Applying the security update is the recommended solution.
You can find more information about this vulnerability, including the impact and CVSS score, on the CVE page: CVE-2022-3094.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
