CVE search results

11 – 20 of 153 results

Detailed view

Sort by:

CVE-2023-5680

Medium priority

Not affected

If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance. This issue affects BIND 9 versions...

2 affected packages

bind9, isc-dhcp

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
bind9	Not affected	Not affected	Not affected	Not affected
isc-dhcp	Not affected	Not affected	Not affected	Not affected

CVE-2023-5679

Medium priority

Some fixes available 5 of 6

A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45,...

3 affected packages

bind9, isc-dhcp, bind9-libs

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
bind9	Fixed	Fixed	Not affected	Not affected
isc-dhcp	Not affected	Not affected	Not affected	Needs evaluation
bind9-libs	Not in release	Not affected	Not affected	Not in release

CVE-2023-5517

Medium priority

Some fixes available 6 of 8

A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect <domain>;` is configured, and - the resolver receives a PTR query for an RFC 1918 address that would normally...

3 affected packages

bind9, isc-dhcp, bind9-libs

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
bind9	Fixed	Fixed	Fixed	Needs evaluation
isc-dhcp	Not affected	Not affected	Not affected	Not affected
bind9-libs	Not in release	Not affected	Not affected	Not in release

CVE-2023-50868

Medium priority

Some fixes available 23 of 44

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random...

7 affected packages

bind9, isc-dhcp, unbound, dnsmasq, pdns-recursor...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
bind9	Fixed	Fixed	Fixed	Fixed
isc-dhcp	Needs evaluation	Not affected	Not affected	Needs evaluation
unbound	Fixed	Fixed	Fixed	Needs evaluation
dnsmasq	Fixed	Fixed	Fixed	Fixed
pdns-recursor	Not affected	Needs evaluation	Needs evaluation	Needs evaluation
knot-resolver	Not affected	Needs evaluation	Needs evaluation	Needs evaluation
bind9-libs	Not in release	Needs evaluation	Needs evaluation	Not in release

CVE-2023-50387

Medium priority

Some fixes available 23 of 44

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the “KeyTrap” issue. One of...

7 affected packages

bind9, isc-dhcp, unbound, dnsmasq, pdns-recursor...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
bind9	Fixed	Fixed	Fixed	Fixed
isc-dhcp	Needs evaluation	Not affected	Not affected	Needs evaluation
unbound	Fixed	Fixed	Fixed	Needs evaluation
dnsmasq	Fixed	Fixed	Fixed	Fixed
pdns-recursor	Not affected	Needs evaluation	Needs evaluation	Needs evaluation
knot-resolver	Not affected	Needs evaluation	Needs evaluation	Needs evaluation
bind9-libs	Not in release	Needs evaluation	Needs evaluation	Not in release

CVE-2023-4408

Medium priority

Some fixes available 6 of 16

The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the...

3 affected packages

bind9, isc-dhcp, bind9-libs

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
bind9	Fixed	Fixed	Fixed	Needs evaluation
isc-dhcp	Needs evaluation	Not affected	Not affected	Needs evaluation
bind9-libs	Not in release	Needs evaluation	Needs evaluation	Not in release

CVE-2023-4236

Medium priority

Some fixes available 6 of 7

A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal data structures are incorrectly reused under significant DNS-over-TLS...

2 affected packages

bind9, isc-dhcp

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
bind9	Fixed	Fixed	Not affected	Not affected
isc-dhcp	Not affected	Not affected	Not affected	Needs evaluation

CVE-2023-3341

Medium priority

Some fixes available 10 of 11

The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this...

2 affected packages

bind9, isc-dhcp

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
bind9	Fixed	Fixed	Fixed	Fixed
isc-dhcp	Not affected	Not affected	Not affected	Needs evaluation

CVE-2023-2911

Medium priority

Some fixes available 8 of 11

If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop...

3 affected packages

bind9, isc-dhcp, bind9-libs

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
bind9	Fixed	Fixed	Fixed	Not affected
isc-dhcp	Not affected	Not affected	Not affected	Needs evaluation
bind9-libs	Not in release	Not affected	Not affected	Not in release

CVE-2023-2829

Medium priority

Not affected

A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from-dnssec`) enabled can be remotely terminated using a zone with a...

2 affected packages

bind9, isc-dhcp

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
bind9	—	Not affected	Not affected	Not affected
isc-dhcp	—	Not affected	Not affected	Not affected

Export to JSON

Results by page:

Search CVE reports