CVE-2021-25220
DNS forwarders - cache poisoning vulnerability
MEDIUM 6.8
En bref
- Source
- NVD
- EPSS
- EPSS 3.45 % · centile 89 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- isc
- Statut NVD
- Modified
Description
BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.
Faiblesses (CWE)
- CWE-444 — Dissimulation de requête ou de réponse HTTP
Références
- https://kb.isc.org/v1/docs/cve-2021-25220
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYD7US4HZRFUGAJ66ZTHFBYVP5N3OQBY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/API7U5E7SX7BAAVFNW366FFJGD6NZZKV/
- https://security.netapp.com/advisory/ntap-20220408-0001/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VX3I2U3ICOIEI5Y7OYA6CHOLFMNH3YQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2SXT7247QTKNBQ67MNRGZD23ADXU6E5U/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DE3UAVCPUMAKG27ZL5YXSP2C3RIOW3JZ/
- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
- https://security.gentoo.org/glsa/202210-25
- https://supportportal.juniper.net/s/article/2022-10-Security-Bulletin-Junos-OS-SRX-Series-Cache-poisoning-vulnerability-in-BIND-used-by-DNS-Proxy-CVE-2021-25220?language=en_US
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N | isc |
| CVSS 3.1 | MEDIUM 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N | NVD · security-officer@isc.org (Secondary) |
| CVSS 3.1 | MEDIUM 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N | NVD · nvd@nist.gov (Secondary) |
| CVSS 2.0 | MEDIUM 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2021-12131
- GCVE · GCVE-0-2021-25220
Avis du CERT-FR
- CERTFR-2025-AVI-0756 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0027 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0537 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0276 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2022-AVI-916 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2022-AVI-814 — Multiples vulnérabilités dans les produits SIEMENS · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*≥ 9.11.0 < 9.11.37cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*≥ 9.11.4 < 9.11.37cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*≥ 9.12.0 < 9.16.27cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*≥ 9.16.8 < 9.16.27cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*≥ 9.17.0 ≤ 9.18.0cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*< 1.0cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*< 19.3cpe:2.3:o:juniper:junos:19.3:-:*:*:*:*:*:*cpe:2.3:o:juniper:junos:19.3:r1-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:19.3:r2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:19.3:r2-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:19.3:r2-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:19.3:r2-s3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:19.3:r2-s4:*:*:*:*:*:*cpe:2.3:o:juniper:junos:19.3:r2-s5:*:*:*:*:*:*cpe:2.3:o:juniper:junos:19.3:r2-s6:*:*:*:*:*:*cpe:2.3:o:juniper:junos:19.3:r2-s7:*:*:*:*:*:*cpe:2.3:o:juniper:junos:19.3:r3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:19.3:r3-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:19.3:r3-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:19.3:r3-s3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:19.3:r3-s4:*:*:*:*:*:*cpe:2.3:o:juniper:junos:19.3:r3-s5:*:*:*:*:*:*cpe:2.3:o:juniper:junos:19.3:r3-s6:*:*:*:*:*:*cpe:2.3:o:juniper:junos:19.4:-:*:*:*:*:*:*cpe:2.3:o:juniper:junos:19.4:r1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:19.4:r1-s1:*:*:*:*:*:*- +90 autres
Produits affectés
| Produit | Versions |
|---|---|
| ISC · BIND | affected Open Source Branch 9.11 9.11.0 through versions before 9.11.37 ; affected Development Branch 9.17 BIND 9.17 all version ; affected Open Source Branch 9.12-16 9.12.0 through versions before 9.16.27 ; affected Open Source Branch 9.18 9.18.0 ; affected Supported Preview Branch 9.11-S 9.11.0-S through versions before 9.11.37-S ; affected Supported Preview Branch 9.16-S 9.16.0-S through versions before 9.16.27-S |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |