Denial of Service Vulnerability in bind package
Summary
CVE-2022-2795: By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service. Affects bind across 3 version ranges.
>= 8db45afa1affcb823e68afdeddedf93e136f5d3e, < 85a6eb108e884467c4b3af414140d6b033a89a62
< 9.16.33-r0
>= 19d6c56085e97cf4ac559cdc27edd624127bcb32, < 35e9c6e31dd742f501624a31c3326db1c7b460fe
Fixed in 9.16.33-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bind package is a DNS resolver that provides DNS resolution services to clients. It is widely used in various operating systems and distributions. The bind package is responsible for translating domain names into IP addresses and vice versa. It plays a critical role in the functioning of the internet infrastructure.
Vulnerability Detail
The vulnerability, identified as CVE-2022-2795, allows an attacker to impair the performance of the bind resolver by flooding it with queries. This can lead to a denial of service (DoS) situation, where legitimate clients are unable to access the DNS resolution service. The impact of this vulnerability can be significant, affecting the availability and reliability of DNS services.
How To Fix
Minimum fixed version
9.16.33-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the bind package to the latest version.
Conclusion
The bind package is vulnerable to a denial of service attack that can significantly impair the resolver's performance. To mitigate this vulnerability, it is crucial to update the bind package to version 9.16.33-r0 or later. Failure to address this vulnerability can lead to service disruptions and impact the availability of DNS resolution services. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for bind →
FAQ
The bind package is a DNS resolver that translates domain names into IP addresses and vice versa. It is widely used in various operating systems and distributions.
The vulnerability allows an attacker to impair the performance of the bind resolver, leading to a denial of service situation where legitimate clients are unable to access the DNS resolution service.
To fix this vulnerability, update the bind package to version 9.16.33-r0 or later.
There is no known workaround for this vulnerability. It is essential to update the bind package to the latest version.
For more information about this vulnerability, refer to the CVE-2022-2795 entry in the National Vulnerability Database (NVD).
Related vulnerabilities
Recent vulnerabilities recorded for bind.
