Vulnerability in BIND package: CVE-2023-5680
Summary
CVE-2023-5680: If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance. Affects bind across 4 version ranges.
< 2b060b2cc30fd7d92b805751fa6c7f72fd000f23
< 9.16.48-r0
< 617639b7cc40ba9eb6fde2d98099726d50da812e
< eba38b89007f65bc6c1fdd2451034bbe3908b9a4
Fixed in 9.16.48-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND is a widely used open-source DNS software package that provides name resolution services on the Internet. It is responsible for translating domain names into IP addresses and vice versa. The package is commonly used by network administrators and service providers to manage DNS infrastructure. However, a vulnerability has been discovered in BIND that can significantly impair query performance if a resolver cache has a large number of ECS records stored for the same name.
Vulnerability Detail
The vulnerability, identified as CVE-2023-5680, affects BIND versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. When a resolver cache contains numerous ECS records for a specific name, the process of cleaning the cache database node for that name can lead to a significant degradation in query performance. This issue can impact the overall DNS resolution process and cause delays or timeouts for DNS queries.
How To Fix
Minimum fixed version
9.16.48-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the provided fix by updating the BIND package to the recommended versions.
Conclusion
The vulnerability in BIND can significantly impact query performance and cause delays or timeouts for DNS queries. It is crucial to update the BIND package to the recommended fixed versions to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bind →
FAQ
BIND is an open-source DNS software package used for domain name resolution.
The vulnerability can significantly impair query performance in BIND, leading to delays or timeouts for DNS queries.
BIND versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1 are affected.
To fix this vulnerability, update the BIND package to version 9.16.48-r0 or later for versions 9.11.x and 9.16.x, and version 9.18.24-r0 or later for version 9.18.x.
No, there is no known workaround for this vulnerability. Updating the BIND package is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
