Vulnerability in BIND package (CVE-2021-25219)
Summary
CVE-2021-25219: In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development b... Affects bind across 3 version ranges.
< 9.16.27-r0
>= 71a40862c0be867999867cd99e21c2266a5e452b, < 59bfaba3250b291462940df5950e0098a6abb324
>= e8a547a3ebd21845a311580c772606e14c2eccfe, < 68dbd5b966f4ecea28ed4915580edd330bc481a3
Fixed in 9.16.27-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND is a widely used open-source DNS server software package. It provides DNS services for resolving domain names to IP addresses and vice versa. The package is an essential component of many network infrastructures. However, a vulnerability has been discovered in BIND versions 9.3.0 to 9.11.35, 9.12.0 to 9.16.21, and 9.9.3-S1 to 9.11.35-S1 and 9.16.8-S1 to 9.16.21-S1. This vulnerability can lead to performance degradation in BIND resolver due to a flaw in response processing.
Vulnerability Detail
The vulnerability in BIND arises from the design of the lame cache, which can cause its internal data structures to grow indefinitely. This can result in significant delays in client query processing. Exploitation of this flaw can lead to a degradation in BIND resolver performance. The impact of this vulnerability can be severe, affecting the responsiveness and reliability of DNS resolution services.
How To Fix
Minimum fixed version
9.16.27-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. The recommended solution is to update BIND to the fixed version.
Conclusion
The vulnerability in BIND can result in performance degradation and delays in DNS resolution services. It is crucial to update BIND to the fixed version to mitigate this vulnerability and ensure the security and optimal performance of the DNS server. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bind →
FAQ
BIND is an open-source DNS server software package that provides DNS services for resolving domain names to IP addresses and vice versa.
The vulnerability affects BIND versions 9.3.0 to 9.11.35, 9.12.0 to 9.16.21, and 9.9.3-S1 to 9.11.35-S1 and 9.16.8-S1 to 9.16.21-S1.
The vulnerability can cause degradation in BIND resolver performance, leading to delays in client query processing and affecting the responsiveness and reliability of DNS resolution services.
To fix this vulnerability, update BIND to version 9.16.27-r0 or later, which includes a fix for the flaw in response processing.
No, there is no specific workaround available. Updating BIND to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
