Moderate: bind security and bug fix update
Summary
ALSA-2023:2261: Moderate: bind security and bug fix update. Affects bind versions < 32:9.16.23-11.el9. Fixed in 32:9.16.23-11.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Vulnerability Detail
This vulnerability affects the BIND package and includes the following security issues:
- Processing large delegations may severely degrade resolver performance (CVE-2022-2795)
- Flooding with UPDATE requests may lead to Denial of Service (DoS) (CVE-2022-3094)
- Sending specific queries to the resolver may cause a DoS (CVE-2022-3736)
- Sending specific queries to the resolver may cause a DoS (CVE-2022-3924)
These vulnerabilities can have various impacts, including performance degradation and potential denial of service attacks.
How To Fix
Minimum fixed version
32:9.16.23-11.el9
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the BIND package is affected by multiple vulnerabilities that can result in performance degradation and potential denial of service attacks. It is recommended to update the package to the latest version to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bind →
FAQ
BIND is an implementation of the Domain Name System (DNS) protocols, providing a DNS server, resolver library, and tools for DNS server verification.
The vulnerabilities can result in performance degradation and potential denial of service attacks.
To fix these vulnerabilities, update the BIND package to version 9.16.23-11.el9 or later.
No specific workarounds have been provided for these vulnerabilities.
You can find more information about these vulnerabilities in the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
