7.5Hoch

CVE-2020-8623A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c

ISC BIND9 Veröffentlicht: 2020-08-21 23:50 (vor 6 Jahren)

Beschreibung

In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with "--enable-native-pkcs11" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
ISC	BIND9	9.10.0 – < unspecified, unspecified – < 9.11.22, 9.12.0 – < unspecified, unspecified – < 9.16.6, 9.17.0 – < unspecified, unspecified – < 9.17.4, 9.10.5-S1 – < Supported Preview*

Referenzen und Patches

https://kb.isc.org/docs/cve-2020-8623
FEDORA-2020-a02b7a0f21 vendor-advisory
https://security.netapp.com/advisory/ntap-20200827-0003/
USN-4468-1 vendor-advisory
DSA-4752 vendor-advisory
FEDORA-2020-14c194e5af vendor-advisory
[debian-lts-announce] 20200829 [SECURITY] [DLA 2355-1] bind9 security update mailing-list
GLSA-202008-19 vendor-advisory
https://www.synology.com/security/advisory/Synology_SA_20_19
openSUSE-SU-2020:1699 vendor-advisory
openSUSE-SU-2020:1701 vendor-advisory

CVSS-Score

7.5Hoch

Quelle: isc · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Keine
Integrität: Keine
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

6.61%

höher als 94 % aller CVEs

Zeitverlauf

ID reserviert2020-02-05
Veröffentlicht2020-08-21 23:50
Bei IP-DB eingegangen2026-10-25 00:04
Zuletzt aktualisiert2024-09-17 06:19

Vergeben von (CNA): isc

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — ISC BIND 9

7.5Hoch

CVE-2026-97313 vor 18 Tagen

Specific RPZ configurations and query patterns may result in an unexpected exit

ISC BIND 9

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have …

7.5Hoch

CVE-2026-96888 vor 18 Tagen

Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization

ISC BIND 9

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through…

8.1Hoch

CVE-2026-94300 vor 18 Tagen

Concurrent GSS-TSIG messages corrupt memory

ISC BIND 9

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacke…

7.5Hoch

CVE-2026-19630 vor 18 Tagen

Amplified resource exhaustion in inbound message processing

ISC BIND 9

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate am…

5.9Mittel

CVE-2026-77119 vor 1 Monat

NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets

ISC BIND 9

A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21…

5.3Mittel

CVE-2026-75029 vor 1 Monat

Message parser retains every identical singleton RDATA, enabling wire-to-work amplification

ISC BIND 9

In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory …