Headline
Red Hat Security Advisory 2022-8068-01
Red Hat Security Advisory 2022-8068-01 - The Berkeley Internet Name Domain is an implementation of the Domain Name System protocols. BIND includes a DNS server ; a resolver library ; and tools for verifying that the DNS server is operating correctly. Issues addressed include a denial of service vulnerability.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: bind security update
Advisory ID: RHSA-2022:8068-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:8068
Issue date: 2022-11-15
CVE Names: CVE-2021-25220 CVE-2022-0396
====================================================================
- Summary:
An update for bind is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat CodeReady Linux Builder (v. 9) - aarch64, noarch, ppc64le, s390x, x86_64
Red Hat Enterprise Linux AppStream (v. 9) - aarch64, noarch, ppc64le, s390x, x86_64
- Description:
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain
Name System (DNS) protocols. BIND includes a DNS server (named); a resolver
library (routines for applications to use when interfacing with DNS); and
tools for verifying that the DNS server is operating correctly.
Security Fix(es):
bind: DNS forwarders - cache poisoning vulnerability (CVE-2021-25220)
bind: DoS from specifically crafted TCP packets (CVE-2022-0396)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 9.1 Release Notes linked from the References section.
- Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the update, the BIND daemon (named) will be restarted
automatically.
- Bugs fixed (https://bugzilla.redhat.com/):
2064512 - CVE-2021-25220 bind: DNS forwarders - cache poisoning vulnerability
2064513 - CVE-2022-0396 bind: DoS from specifically crafted TCP packets
2104863 - bind-doc is not shipped to public
- Package List:
Red Hat Enterprise Linux AppStream (v. 9):
Source:
bind-9.16.23-5.el9_1.src.rpm
aarch64:
bind-9.16.23-5.el9_1.aarch64.rpm
bind-chroot-9.16.23-5.el9_1.aarch64.rpm
bind-debuginfo-9.16.23-5.el9_1.aarch64.rpm
bind-debugsource-9.16.23-5.el9_1.aarch64.rpm
bind-dnssec-utils-9.16.23-5.el9_1.aarch64.rpm
bind-dnssec-utils-debuginfo-9.16.23-5.el9_1.aarch64.rpm
bind-libs-9.16.23-5.el9_1.aarch64.rpm
bind-libs-debuginfo-9.16.23-5.el9_1.aarch64.rpm
bind-utils-9.16.23-5.el9_1.aarch64.rpm
bind-utils-debuginfo-9.16.23-5.el9_1.aarch64.rpm
noarch:
bind-dnssec-doc-9.16.23-5.el9_1.noarch.rpm
bind-license-9.16.23-5.el9_1.noarch.rpm
python3-bind-9.16.23-5.el9_1.noarch.rpm
ppc64le:
bind-9.16.23-5.el9_1.ppc64le.rpm
bind-chroot-9.16.23-5.el9_1.ppc64le.rpm
bind-debuginfo-9.16.23-5.el9_1.ppc64le.rpm
bind-debugsource-9.16.23-5.el9_1.ppc64le.rpm
bind-dnssec-utils-9.16.23-5.el9_1.ppc64le.rpm
bind-dnssec-utils-debuginfo-9.16.23-5.el9_1.ppc64le.rpm
bind-libs-9.16.23-5.el9_1.ppc64le.rpm
bind-libs-debuginfo-9.16.23-5.el9_1.ppc64le.rpm
bind-utils-9.16.23-5.el9_1.ppc64le.rpm
bind-utils-debuginfo-9.16.23-5.el9_1.ppc64le.rpm
s390x:
bind-9.16.23-5.el9_1.s390x.rpm
bind-chroot-9.16.23-5.el9_1.s390x.rpm
bind-debuginfo-9.16.23-5.el9_1.s390x.rpm
bind-debugsource-9.16.23-5.el9_1.s390x.rpm
bind-dnssec-utils-9.16.23-5.el9_1.s390x.rpm
bind-dnssec-utils-debuginfo-9.16.23-5.el9_1.s390x.rpm
bind-libs-9.16.23-5.el9_1.s390x.rpm
bind-libs-debuginfo-9.16.23-5.el9_1.s390x.rpm
bind-utils-9.16.23-5.el9_1.s390x.rpm
bind-utils-debuginfo-9.16.23-5.el9_1.s390x.rpm
x86_64:
bind-9.16.23-5.el9_1.x86_64.rpm
bind-chroot-9.16.23-5.el9_1.x86_64.rpm
bind-debuginfo-9.16.23-5.el9_1.x86_64.rpm
bind-debugsource-9.16.23-5.el9_1.x86_64.rpm
bind-dnssec-utils-9.16.23-5.el9_1.x86_64.rpm
bind-dnssec-utils-debuginfo-9.16.23-5.el9_1.x86_64.rpm
bind-libs-9.16.23-5.el9_1.x86_64.rpm
bind-libs-debuginfo-9.16.23-5.el9_1.x86_64.rpm
bind-utils-9.16.23-5.el9_1.x86_64.rpm
bind-utils-debuginfo-9.16.23-5.el9_1.x86_64.rpm
Red Hat CodeReady Linux Builder (v. 9):
aarch64:
bind-debuginfo-9.16.23-5.el9_1.aarch64.rpm
bind-debugsource-9.16.23-5.el9_1.aarch64.rpm
bind-devel-9.16.23-5.el9_1.aarch64.rpm
bind-dnssec-utils-debuginfo-9.16.23-5.el9_1.aarch64.rpm
bind-libs-debuginfo-9.16.23-5.el9_1.aarch64.rpm
bind-utils-debuginfo-9.16.23-5.el9_1.aarch64.rpm
noarch:
bind-doc-9.16.23-5.el9_1.noarch.rpm
ppc64le:
bind-debuginfo-9.16.23-5.el9_1.ppc64le.rpm
bind-debugsource-9.16.23-5.el9_1.ppc64le.rpm
bind-devel-9.16.23-5.el9_1.ppc64le.rpm
bind-dnssec-utils-debuginfo-9.16.23-5.el9_1.ppc64le.rpm
bind-libs-debuginfo-9.16.23-5.el9_1.ppc64le.rpm
bind-utils-debuginfo-9.16.23-5.el9_1.ppc64le.rpm
s390x:
bind-debuginfo-9.16.23-5.el9_1.s390x.rpm
bind-debugsource-9.16.23-5.el9_1.s390x.rpm
bind-devel-9.16.23-5.el9_1.s390x.rpm
bind-dnssec-utils-debuginfo-9.16.23-5.el9_1.s390x.rpm
bind-libs-debuginfo-9.16.23-5.el9_1.s390x.rpm
bind-utils-debuginfo-9.16.23-5.el9_1.s390x.rpm
x86_64:
bind-debuginfo-9.16.23-5.el9_1.i686.rpm
bind-debuginfo-9.16.23-5.el9_1.x86_64.rpm
bind-debugsource-9.16.23-5.el9_1.i686.rpm
bind-debugsource-9.16.23-5.el9_1.x86_64.rpm
bind-devel-9.16.23-5.el9_1.i686.rpm
bind-devel-9.16.23-5.el9_1.x86_64.rpm
bind-dnssec-utils-debuginfo-9.16.23-5.el9_1.i686.rpm
bind-dnssec-utils-debuginfo-9.16.23-5.el9_1.x86_64.rpm
bind-libs-9.16.23-5.el9_1.i686.rpm
bind-libs-debuginfo-9.16.23-5.el9_1.i686.rpm
bind-libs-debuginfo-9.16.23-5.el9_1.x86_64.rpm
bind-utils-debuginfo-9.16.23-5.el9_1.i686.rpm
bind-utils-debuginfo-9.16.23-5.el9_1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2021-25220
https://access.redhat.com/security/cve/CVE-2022-0396
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBY3PhLdzjgjWX9erEAQhVSw/9HlIwMZZuRgTsbY2yARvJ+sRk08hViRo6
++sV0vMtt3ym5eQES1al4uwAFbVH3B+EZLVuox02PnKVvIM35QnzVFxSa24HToTp
l3tl+c9QnDwx3VGceX9og5o/ezSKqT8UeMQF/gamcB5kwGbbeb+Gp7cpSyXsmjB1
h418DMq/BBE1kLx2MAmIAn/r8x8ISsRbk3j96VEtLrQDtbSKCrE7jmQMaGRB4NhK
4pcgEdcVC6mpBIBRSoLqSVvY9cEdbWqB2LBKArSic/GS2RFfXiSTbPP+kHhd8WHF
0pHQpQa2CXqWuoyrk4cmlvyqmp+C1oCuwsjUWm3dIouIpLU3P1PH3Xua+DMcHfNl
z3wW5E8hihVQ7taw/c6jKMlIrPVzdNM7zfdqV4PBoMQ6y6nPDP23wNGIBMIArjO/
n841K1Lzp1vrChLKgtYOK4H/s6Fbtb/+fe6Q5wOVPPEeksfoKzjJjZj/J7J+RymH
Bd6n+f9iMQzOkj9zb6cgrvt2aLcr29XHfcCRH81i/CEPAEFGT86qOXqIZO0+qV/u
qhHDKy3rLqYsOR4BlwhFhovUGCt8rBJ8LOiZlUTxzNG4PNze4F1hG1d0qzYQv0Iw
zfOrgT8NGDmGCt2nwtmy813NDmzVegwrS7w0ayLzpcwcJMVOoO0nKi5kzX1slEyu
rbPwX0ROLTo=0klO
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
Dell Unity 5.3 contain(s) an Arbitrary File Creation vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by crafting arbitrary files through a request to the server.
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The supported version that is affected is 11.2.13.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. While the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
Red Hat Security Advisory 2023-0402-01 - An update for bind is now available for Red Hat Enterprise Linux 7.
An update for bind is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-25220: bind: DNS forwarders - cache poisoning vulnerability * CVE-2022-2795: bind: processing large delegations may severely degrade resolver performance
Red Hat Security Advisory 2022-8385-01 - The Dynamic Host Configuration Protocol is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network.
An update for bind is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-25220: bind: DNS forwarders - cache poisoning vulnerability * CVE-2022-0396: bind: DoS from specifically crafted TCP packets
An update for bind is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-25220: bind: DNS forwarders - cache poisoning vulnerability * CVE-2022-0396: bind: DoS from specifically crafted TCP packets
An update for dhcp is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-25220: bind: DNS forwarders - cache poisoning vulnerability
Red Hat Security Advisory 2022-7643-01 - The Berkeley Internet Name Domain is an implementation of the Domain Name System protocols. BIND includes a DNS server ; a resolver library ; and tools for verifying that the DNS server is operating correctly. Issues addressed include denial of service and memory leak vulnerabilities.
Red Hat Security Advisory 2022-7643-01 - The Berkeley Internet Name Domain is an implementation of the Domain Name System protocols. BIND includes a DNS server ; a resolver library ; and tools for verifying that the DNS server is operating correctly. Issues addressed include denial of service and memory leak vulnerabilities.
An update for bind9.16 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-25220: bind: DNS forwarders - cache poisoning vulnerability * CVE-2022-0396: bind: DoS from specifically crafted TCP packets
An update for bind9.16 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-25220: bind: DNS forwarders - cache poisoning vulnerability * CVE-2022-0396: bind: DoS from specifically crafted TCP packets
An update for bind is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-25220: bind: DNS forwarders - cache poisoning vulnerability
BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.
BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has terminated the connection.