CVE-2020-8624 update-policy rules of type "subdomain" are enforced incorrectly

🗓️ 21 Aug 2020 20:50:20Reported by iscType

CVE-2020-8624 BIND update-policy subdomain rules enforcement vulnerabilit

Reporter	Title	Published	Views	Family All 139
ALT Linux	Security fix for the ALT Linux 10 package bind version 9.11.22-alt1	21 Aug 202000:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package bind version 9.11.22-alt1	26 Aug 202000:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 8 package bind version 9.10.8.P1-alt3	24 Aug 202000:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Vulnerability in bind affects IBM Integrated Analytics System	30 Apr 202111:21	–	ibm
IBM Security Bulletins	Security Bulletin: BIND for IBM i is affected by CVE-2020-8622 and CVE-2020-8624	20 Oct 202018:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Appliance is affected by multiple BIND vulnerabilities (CVE-2020-8622, CVE-2020-8623, CVE-2020-8624)	17 Feb 202110:09	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in BIND affect Power Hardware Management Console (CVE-2020-8622, CVE-2020-8623 and CVE-2020-8624)	22 Sep 202123:38	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to several CVEs	19 Oct 202115:38	–	ibm
Tenable Nessus	Amazon Linux 2 : bind (ALAS-2020-1564)	9 Dec 202000:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0025: bind (ALINUX3-SA-2021:0025)	14 May 202500:00	–	nessus

[
  {
    "product": "BIND9",
    "vendor": "ISC",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "9.9.12",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "9.9.13",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "9.10.7",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "9.10.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "9.11.3",
        "versionType": "custom"
      },
      {
        "lessThan": "9.11.22",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "9.12.1",
        "versionType": "custom"
      },
      {
        "lessThan": "9.16.6",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "9.17.0",
        "versionType": "custom"
      },
      {
        "lessThan": "9.17.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "9.9.12-S1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "9.9.13-S1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "9.11.3-S1",
        "versionType": "custom"
      },
      {
        "lessThan": "9.11.22-S1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
usn	www.usn.ubuntu.com/4468-1/
synology	www.synology.com/security/advisory/Synology_SA_20_19
debian	www.debian.org/security/2020/dsa-4752
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKAMJZXR66P6S5LEU4SN7USSNCWTXEXP/
security	www.security.gentoo.org/glsa/202008-19
security	www.security.netapp.com/advisory/ntap-20200827-0003/
lists	www.lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQN62GBMCIC5AY4KYADGXNKVY6AJKSJE/
lists	www.lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
kb	www.kb.isc.org/docs/cve-2020-8624

20 Oct 2020 11:06Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.14.3

EPSS0.0364