CVE-2022-38178
Memory leaks in EdDSA DNSSEC verification code
En bref Sévérité HIGH 7.5 EPSS EPSS 3.11 % · centile 88 (2026-10-28) État PUBLISHED Publiée 2022-09-21 Mise à jour 2025-05-28 Attribuée par isc Statut NVD Modified Description By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
Scores Version Score Vecteur Évalué par CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H isc CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD · security-officer@isc.org (Secondary) CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.9.12 ≤ 9.9.13cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.10.7 ≤ 9.10.8cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* ≥ 9.11.3 ≤ 9.16.32cpe:2.3:a:isc:bind:9.11.3:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.3:s4:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.5:s3:*:*:*:*:*:*cpe:2.3:a:isc:bind:9.11.5:s3:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.5:s5:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.5:s6:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.6:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.7:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.8:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.12:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.14-s1:*:*:*:preview:*:*:*cpe:2.3:a:isc:bind:9.11.19-s1:*:*:*:preview:*:*:*cpe:2.3:a:isc:bind:9.11.21:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.27:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.29:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.35:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.11.37:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.16.8:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.16.11:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.16.13:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.16.21:s1:*:*:supported_preview:*:*:*cpe:2.3:a:isc:bind:9.16.32:s1:*:*:supported_preview:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*Produits affectés Produit Versions ISC · BIND9 affected Open Source Branch 9.9 9.9.12 through versions up to and including 9.9.13 ; affected Open Source Branch 9.10 9.10.7 through versions up to and including 9.10.8 ; affected Open Source Branches 9.11 through 9.16 9.11.3 through versions before 9.16.33 ; affected Open Source Branch 9.18 9.18.0 through versions before 9.18.7 ; affected Supported Preview Branch 9.11-S 9.11.4-S1 through versions up to and including 9.11.37-S1 ; affected Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1
Références
Sources
