ISC BIND9
23 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2022-38178 | Open Source Branch 9.9 9.9.12 through versions up to and including 9.9.13 ; Open Source Branch 9.10 9.10.7 through versions up to and including 9.10.8 ; Open Source Branches 9.11 through 9.16 9.11.3 through versions before 9.16.33 ; … | Memory leaks in EdDSA DNSSEC verification code | HIGH 7.5 | 3.1 % | ||
| CVE-2022-3080 | Open Source Branch 9.16 9.16.14 through versions before 9.16.33 ; Open Source Branch 9.18 9.18.0 through versions before 9.18.7 ; Supported Preview Branch 9.16-S 9.16.14-S1 through versions before 9.16.33-S1 ; … | BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly | HIGH 7.5 | 2.0 % | ||
| CVE-2022-38177 | Open Source Branches 9.8 through 9.16 9.8.4 through versions before 9.16.33 ; Supported Preview Branches 9.9-S through 9.11-S 9.9.4-S1 through versions up to and including 9.11.37-S1 ; Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1 | Memory leak in ECDSA DNSSEC verification code | HIGH 7.5 | 3.3 % | ||
| CVE-2022-2906 | Open Source Branch 9.18 9.18.0 through versions before 9.18.7 ; Development Branch 9.19 9.19.0 through versions before 9.19.5 | Memory leaks in code handling Diffie-Hellman key exchange via TKEY RRs (OpenSSL 3.0.0+ only) | HIGH 7.5 | 2.1 % | ||
| CVE-2022-2881 | Open Source Branch 9.18 9.18.0 through versions before 9.18.7 ; Development Branch 9.19 9.19.0 through versions before 9.19.5 | Buffer overread in statistics channel code | HIGH 8.2 | 1.4 % | ||
| CVE-2022-2795 | Open Source Branches 9.0 through 9.16 9.0.0 through versions before 9.16.33 ; Open Source Branch 9.18 9.18.0 through versions before 9.18.7 ; Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions up to and including 9.11.37-S1 ; … | Processing large delegations may severely degrade resolver performance | MEDIUM 5.3 | 2.3 % | ||
| CVE-2022-1183 | Open Source Branch 9.18 9.18.0 through versions before 9.18.3 ; Development Branch 9.19 9.19.0 | Destroying a TLS session early causes assertion failure | HIGH 7.5 | 6.3 % | ||
| CVE-2021-25219 | Open Source Branches 9.3 through 9.11 9.3.0 through versions before 9.11.36 ; Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.22 ; Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.36-S1 ; … | Lame cache can be abused to severely degrade resolver performance | MEDIUM 5.3 | 11 % | ||
| CVE-2021-25218 | Stable Branch 9.16.19 ; Development Branch 9.17.16 ; Supported Preview Edition 9.16.19-S1 | A too-strict assertion check could be triggered when responses in BIND 9.16.19 and 9.17.16 require UDP fragmentation if RRL is in use | HIGH 7.5 | 3.6 % | ||
| CVE-2021-25216 | Open Source Branches 9.5 though 9.11 9.5.0 through versions before 9.11.31 ; Open Source Branches 9.12 though 9.16 9.12.0 through versions before 9.16.14 ; Supported Preview Branch 9.11-S 9.11.3-S1 through versions before 9.11.31-S1 ; … | A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack | CRITICAL 9.8 | 83 % | ||
| CVE-2021-25215 | Open Source Branches 9.0 through 9.11 9.0.0 through versions before 9.11.30 ; Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.14 ; Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.30-S1 ; … | An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself | HIGH 7.5 | 12 % | ||
| CVE-2021-25214 | Open Source Branch 9.8 9.8.5 through 9.8.8 ; Open Source Branches 9.9 through 9.11 9.9.3 through versions before 9.11.30 ; Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.14 ; … | A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly | MEDIUM 6.5 | 6.3 % | ||
| CVE-2020-8625 | Open Source Branches 9.5 though 9.11 9.5.0 through versions before 9.11.28 ; Open Source Branches 9.12 though 9.16 9.12.0 through versions before 9.16.12 ; Supported Preview Branch 9.11-S 9.11.3-S1 through versions before 9.11.28-S1 ; … | A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack | HIGH 8.1 | 64 % | ||
| CVE-2020-8624 | 9.9.12 – < unspecified ; unspecified – 9.9.13 ; 9.10.7 – < unspecified ; … | update-policy rules of type "subdomain" are enforced incorrectly | MEDIUM 4.3 | 3.7 % | ||
| CVE-2020-8623 | 9.10.0 – < unspecified ; unspecified – < 9.11.22 ; 9.12.0 – < unspecified ; … | A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c | HIGH 7.5 | 6.6 % | ||
| CVE-2020-8622 | 9.0.0 – < unspecified ; unspecified – < 9.11.22 ; 9.12.0 – < unspecified ; … | A truncated TSIG response can lead to an assertion failure | MEDIUM 6.5 | 5.8 % | ||
| CVE-2020-8621 | ≥ 9.14.0 | Attempting QNAME minimization after forwarding can lead to an assertion failure in resolver.c | HIGH 7.5 | 3.0 % | ||
| CVE-2020-8620 | ≥ 9.15.6 | In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection | HIGH 7.5 | 3.8 % | ||
| CVE-2020-8619 | 9.11.14 through versions before 9.11.20 ; 9.16.0 through versions before 9.16.4 ; 9.11.14-S1 through versions before 9.11.20-S1 ; … | A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer | MEDIUM 4.9 | 2.1 % | ||
| CVE-2020-8618 | 9.16.0 -> 9.16.3 | A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer | MEDIUM 4.9 | 1.8 % | ||
| CVE-2020-8617 | 9.0.0 -> 9.11.18, 9.12.0 -> 9.12.4-P2, 9.14.0 -> 9.14.11, 9.16.0 -> 9.16.2, and releases 9.17.0 -> 9.17.1 of the 9.17 experimental development branch. All releases in the obsolete 9.13 and 9.15 development branches. All releases of BIND Supported Preview Edition from 9.9.3-S1 -> 9.11.18-S1 | A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c | HIGH 7.5 | 93 % | ||
| CVE-2020-8616 | 9.0.0 -> 9.11.18, 9.12.0 -> 9.12.4-P2, 9.14.0 -> 9.14.11, 9.16.0 -> 9.16.2, and releases 9.17.0 -> 9.17.1 of the 9.17 experimental development branch. All releases in the obsolete 9.13 and 9.15 development branches. All releases of BIND Supported Preview Edition from 9.9.3-S1 -> 9.11.18-S1 | BIND does not sufficiently limit the number of fetches performed when processing referrals | HIGH 8.6 | 11 % | ||
| CVE-2019-6477 | 9.11.6-P1 -> 9.11.12, 9.12.4-P1 -> 9.12.4-P2, 9.14.1 -> 9.14.7, and versions 9.11.5-S6 -> 9.11.12-S1 of BIND 9 Supported Preview Edition. Versions 9.15.0 -> 9.15.5 of the BIND 9.15 development branch are also affected | TCP-pipelined queries can bypass tcp-clients limit | HIGH 7.5 | 4.1 % |