Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 2128600 (CVE-2022-3080)
| Summary: | CVE-2022-3080 bind: BIND 9 resolvers configured to answer from cache with zero stale-answer-timeout may terminate unexpectedly | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marian Rehak <mrehak> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aegorenkov.91, anon.amish, dns-sig, jorton, mosvald, mruprich, pavel, pemensik, security-response-team, vonsch, zdohnal |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | bind 9.16.33, bind 9.18.7, bind 9.19.5 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in the Bind package, where the resolver can crash when stale cache and stale answers are enabled, option stale-answer-client-timeout is set to 0 and there is a stale CNAME in the cache for an incoming query. By sending specific queries to the resolver, an attacker can cause named to crash.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-12-06 08:20:28 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2128706, 2128708, 2128748, 2128749, 2128750, 2128751, 2128752, 2128753, 2128754, 2128755, 2128756, 2128757, 2128758, 2128759 | ||
| Bug Blocks: | |||
|
Description
Marian Rehak
2022-09-21 08:40:06 UTC
Created bind tracking bugs for this issue: Affects: fedora-all [bug 2128706] Created dhcp tracking bugs for this issue: Affects: fedora-all [bug 2128708] This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:6763 https://access.redhat.com/errata/RHSA-2022:6763 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:6781 https://access.redhat.com/errata/RHSA-2022:6781 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-3080 |