Important: BIND Security Update
Summary
ALSA-2024:1789: Important: bind security update. Affects bind versions < 32:9.16.23-14.el9_3.4. Fixed in 32:9.16.23-14.el9_3.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library, and tools for DNS server verification. BIND is widely used to manage DNS infrastructure and facilitate domain name resolution.
Vulnerability Detail
This security update addresses multiple vulnerabilities in BIND:
- CVE-2023-50868: Preparing an NSEC3 closest encloser proof can exhaust CPU resources.
- CVE-2023-50387: KeyTrap - Extreme CPU consumption in DNSSEC validator.
- CVE-2023-6516: Specific recursive query patterns may lead to an out-of-memory condition.
- CVE-2023-5679: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution.
- CVE-2023-5517: Querying RFC 1918 reverse zones may cause an assertion failure when 'nxdomain-redirect' is enabled.
- CVE-2023-4408: Parsing large DNS messages may cause excessive CPU load.
These vulnerabilities can result in various consequences, including CPU exhaustion, extreme CPU consumption, out-of-memory conditions, assertion failures, and excessive CPU load.
How To Fix
Minimum fixed version
32:9.16.23-14.el9_3.4
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
This security update addresses multiple vulnerabilities in BIND that can have significant impacts on DNS infrastructure. It is crucial to update BIND to the latest version to mitigate these vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for bind →
FAQ
BIND is an implementation of the DNS protocols used for domain name resolution.
This update addresses multiple vulnerabilities, including CPU exhaustion, extreme CPU consumption, out-of-memory conditions, assertion failures, and excessive CPU load.
The vulnerabilities can lead to various consequences, such as degraded performance, service disruption, and potential security breaches.
To fix these vulnerabilities, update BIND to version 9.16.23-14.el9_3.4 or later by following the provided steps.
No specific workaround has been mentioned for these vulnerabilities. It is recommended to update BIND to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
