CVE-2022-3736 named configured to answer from stale cache may terminate unexpectedly while processing RRSIG queries

🗓️ 25 Jan 2023 21:39:18Reported by iscType

BIND 9 resolver crash due to stale cache handlin

Reporter	Title	Published	Views	Family All 109
IBM Security Bulletins	Security Bulletin: Vulnerabilities in bind and dnsmasq affect IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products	26 Feb 202515:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i DNS is affected by denial of service attacks due to flaws in ISC BIND (CVE-2022-3094, CVE-2022-3736, CVE-2022-3924).	13 Apr 202317:42	–	ibm
IBM Security Bulletins	Security Bulletin: AIX is vulnerable to denial of service due to ISC BIND (CVE-2022-3094, CVE-2022-3736, CVE-2022-3924)	18 Jul 202316:40	–	ibm
Tenable Nessus	Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2023-161)	20 Apr 202300:00	–	nessus
Tenable Nessus	AlmaLinux 9 : bind (ALSA-2023:2261)	14 May 202300:00	–	nessus
Tenable Nessus	AlmaLinux 8 : bind9.16 (ALSA-2023:2792)	20 May 202300:00	–	nessus
Tenable Nessus	ISC BIND 9.16.12 < 9.16.37 / 9.16.12-S1 < 9.16.37-S1 / 9.18.0 < 9.18.11 / 9.19.0 < 9.19.9 Vulnerability (cve-2022-3736)	26 Jan 202300:00	–	nessus
Tenable Nessus	CentOS 9 : bind-9.16.23-9.el9	29 Feb 202400:00	–	nessus
Tenable Nessus	Debian DSA-5329-1 : bind9 - security update	27 Jan 202300:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP11 : bind (EulerOS-SA-2023-1754)	8 May 202300:00	–	nessus

[
  {
    "vendor": "ISC",
    "product": "BIND 9",
    "versions": [
      {
        "version": "9.16.12",
        "lessThanOrEqual": "9.16.36",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "9.18.0",
        "lessThanOrEqual": "9.18.10",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "9.19.0",
        "lessThanOrEqual": "9.19.8",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "9.16.12-S1",
        "lessThanOrEqual": "9.16.36-S1",
        "status": "affected",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
kb	www.kb.isc.org/docs/cve-2022-3736

26 Jan 2023 06:03Current

7.7High risk

Vulners AI Score7.7

CVSS 3.17.5

EPSS0.5017