Important: bind security update
Summary
ALSA-2024:2551: Important: bind security update. Affects bind versions < 32:9.16.23-18.el9_4.1. Fixed in 32:9.16.23-18.el9_4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Vulnerability Detail
This security update addresses multiple vulnerabilities in BIND:
- CVE-2023-50868: Preparing an NSEC3 closest encloser proof can exhaust CPU resources.
- CVE-2023-50387: KeyTrap - Extreme CPU consumption in DNSSEC validator.
- CVE-2023-6516: Specific recursive query patterns may lead to an out-of-memory condition.
- CVE-2023-5679: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution.
- CVE-2023-5517: Querying RFC 1918 reverse zones may cause an assertion failure when 'nxdomain-redirect' is enabled.
- CVE-2023-4408: Parsing large DNS messages may cause excessive CPU load.
How To Fix
Minimum fixed version
32:9.16.23-18.el9_4.1
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
This security update addresses multiple vulnerabilities in BIND. It is recommended to update the BIND package to the latest version to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for bind →
FAQ
BIND is an implementation of the Domain Name System (DNS) protocols, providing DNS server functionality, resolver library, and tools for DNS server verification.
These vulnerabilities can lead to CPU exhaustion, extreme CPU consumption, out-of-memory conditions, assertion failures, and excessive CPU load. Exploitation of these vulnerabilities may result in denial of service or other security-related issues.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Simply upload your package-lock.json file and Vulert will provide real-time alerts for open-source vulnerabilities.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to update the BIND package to the latest version.
You can refer to the CVE pages listed in the References section of the vulnerability details for more information about each specific vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
