Critical Vulnerability in BIND9 Package: Assertion Failure Risk
Summary
UBUNTU-CVE-2022-1183: On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Affects bind9 versions < 1:9.18.1-1ubuntu1.1. Fixed in 1:9.18.1-1ubuntu1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND9 is a widely used DNS server software that provides name resolution services for the internet. It is known for its reliability and flexibility, supporting various DNS protocols and configurations. However, certain configurations can expose BIND9 to vulnerabilities, such as the one identified in CVE-2022-1183, which can lead to service disruptions.
Vulnerability Detail
The vulnerability arises from specific configurations in the named daemon, particularly when the listen-on statements in named.conf reference HTTP. This can cause the daemon to terminate unexpectedly due to an assertion failure. The affected versions include BIND 9.18.0 to 9.18.2 and version 9.19.0 of the BIND 9.19 development branch. The potential ramifications include service outages and disruptions in DNS resolution, which can affect network operations and accessibility.
How To Fix
Minimum fixed version
1:9.18.1-1ubuntu1.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bind9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your named.conf does not include any references to HTTP in the listen-on statements. This can prevent the assertion failure from occurring until the package is updated.
Conclusion
CVE-2022-1183 presents a significant risk to BIND9 users due to potential assertion failures in specific configurations. It is crucial to update to the patched version to ensure continued reliability and security of DNS services.
See every vulnerability recorded for bind9 →
FAQ
CVE-2022-1183 is a vulnerability in the BIND9 DNS server that can cause the named daemon to terminate unexpectedly due to an assertion failure.
The affected versions include BIND 9.18.0 to 9.18.2 and version 9.19.0 of the BIND 9.19 development branch.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
The CVSS score for CVE-2022-1183 is 7.5, indicating a high severity level.
If immediate updates are not possible, ensure that your configuration does not reference HTTP in the listen-on statements to mitigate the risk temporarily.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.
