CVE-2022-2795

Processing large delegations may severely degrade resolver performance

En bref

Sévérité: MEDIUM 5.3
EPSS: EPSS 2.29 % · centile 83 (2026-10-27)
État: PUBLISHED
Publiée: 2022-09-21
Mise à jour: 2024-11-29
Attribuée par: isc
Statut NVD: Modified

Description

By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	isc
CVSS 3.1	MEDIUM 5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	NVD · security-officer@isc.org (Secondary)
CVSS 3.1	MEDIUM 5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2022-35036
GCVE · GCVE-0-2022-2795

Avis du CERT-FR

CERTFR-2026-AVI-0326 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2026-AVI-0316 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2025-AVI-0756 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2024-AVI-0297 — Multiples vulnérabilités dans Juniper · cert.ssi.gouv.fr
CERTFR-2024-AVI-0027 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
CERTFR-2023-AVI-0537 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
CERTFR-2023-AVI-0276 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2022-AVI-848 — Multiples vulnérabilités dans Bind · cert.ssi.gouv.fr
CERTFR-2022-AVI-1059 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:* ≥ 9.0.0 < 9.16.33
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:* ≥ 9.18.0 < 9.18.7
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:* ≥ 9.19.0 < 9.19.5
cpe:2.3:a:isc:bind:9.9.3:s1:*:*:*:*:*:*
cpe:2.3:a:isc:bind:9.9.3:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.9.12:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.9.13:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.10.5:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.10.7:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.11.3:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.11.5:s3:*:*:*:*:*:*
cpe:2.3:a:isc:bind:9.11.5:s3:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.11.5:s5:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.11.5:s6:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.11.6:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.11.7:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.11.8:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.11.12:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.11.14-s1:*:*:*:preview:*:*:*
cpe:2.3:a:isc:bind:9.11.19-s1:*:*:*:preview:*:*:*
cpe:2.3:a:isc:bind:9.11.21:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.11.27:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.11.29:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.11.35:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.11.37:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.16.8:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.16.11:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.16.13:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.16.21:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:9.16.32:s1:*:*:supported_preview:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
ISC · BIND9	affected Open Source Branches 9.0 through 9.16 9.0.0 through versions before 9.16.33 ; affected Open Source Branch 9.18 9.18.0 through versions before 9.18.7 ; affected Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions up to and including 9.11.37-S1 ; affected Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1 ; affected Development Branch 9.19 9.19.0 through versions before 9.19.5

Produit

Versions

ISC · BIND9

affected Open Source Branches 9.0 through 9.16 9.0.0 through versions before 9.16.33 ; affected Open Source Branch 9.18 9.18.0 through versions before 9.18.7 ; affected Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions up to and including 9.11.37-S1 ; affected Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1 ; affected Development Branch 9.19 9.19.0 through versions before 9.19.5

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD