oss-security - Two vulnerabilities disclosed in BIND (CVE-2020-8616 and CVE-2020-8617)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <054d4faf-ea1d-5354-e33b-8d0b1fe6976b@isc.org>
Date: Tue, 19 May 2020 01:16:04 -0800
From: ISC Security Officer <security-officer@....org>
To: oss-security@...ts.openwall.com
Cc: "security-officer@....org" <security-officer@....org>
Subject: Two vulnerabilities disclosed in BIND (CVE-2020-8616 and
 CVE-2020-8617)

On May 19, 2020, Internet Systems Consortium have disclosed two
vulnerabilities in our BIND 9 software:

   CVE-2020-8616: BIND does not sufficiently limit the number
   of fetches performed when processing referrals
   https://kb.isc.org/docs/cve-2020-8616

   CVE-2020-8617: A logic error in code which checks TSIG
   validity can be used to trigger an assertion failure in tsig.c
   https://kb.isc.org/docs/cve-2020-8617

With the public announcement of these vulnerabilities, the embargo
period is ended and any updated software packages that have been
prepared may be released.

ISC's own releases containing fixes are:

   -  BIND 9.11.19
   -  BIND 9.14.12
   -  BIND 9.16.3

each of which can be downloaded via the ISC downloads page,
https://www.isc.org/downloads

For package maintainers who want *only* the fixes for the
CVE vulnerabilities, patch diffs are available for each branch
in the "patches" subdirectory of the branch's May 2020
maintenance release, e.g.:

  9.11 branch:  https://downloads.isc.org/isc/bind9/9.11.19/patches
  9.14 branch:  https://downloads.isc.org/isc/bind9/9.14.12/patches
  9.16 branch:  https://downloads.isc.org/isc/bind9/9.16.3/patches

Sincerely,

Michael McNally
ISC Security Officer

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.