Lucene search

K
mageiaGentoo FoundationMGASA-2024-0038
HistoryFeb 15, 2024 - 9:36 p.m.

Updated bind packages fix security vulnerabilities

2024-02-1521:36:07
Gentoo Foundation
advisories.mageia.org
47
bind packages
security vulnerabilities
dns messages
cpu load
rfc 1918 reverse zones
nxdomain-redirect
dns64
serve-stale
recursive resolution
keytrap
dnssec validator
nsec3
cpu resources.

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

Low

EPSS

0.05

Percentile

92.9%

The updated packages fix security vulnerabilities: Parsing large DNS messages may cause excessive CPU load. (CVE-2023-4408) Querying RFC 1918 reverse zones may cause an assertion failure when “nxdomain-redirect” is enabled. (CVE-2023-5517) Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution. (CVE-2023-5679) KeyTrap - Extreme CPU consumption in DNSSEC validator. (CVE-2023-50387) Preparing an NSEC3 closest encloser proof can exhaust CPU resources. (CVE-2023-50868)

OSVersionArchitecturePackageVersionFilename
Mageia9noarchbind< 9.18.15-2.3bind-9.18.15-2.3.mga9

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

Low

EPSS

0.05

Percentile

92.9%