oss-security - Four vulnerabilities disclosed in BIND (CVE-2021-25220, CVE-2022-0396, CVE-2022-0635 and CVE-2022-0667)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <c4f4fbb4-04fb-a4e5-0aba-d18533ddaaa9@isc.org>
Date: Wed, 16 Mar 2022 14:51:01 -0500
From: "Everett B. Fulton" <ebf@....org>
To: oss-security@...ts.openwall.com
Subject: Four vulnerabilities disclosed in BIND (CVE-2021-25220,
 CVE-2022-0396, CVE-2022-0635 and CVE-2022-0667)

On March 16 2022, we (Internet Systems Consortium) disclosed four
vulnerabilities affecting our BIND 9 software:

   CVE-2021-25220: DNS forwarders - cache poisoning vulnerability
   https://kb.isc.org/docs/CVE-2021-25220

   CVE-2022-0396: DoS from specifically crafted TCP packets
   https://kb.isc.org/docs/cve-2022-0396

   CVE-2022-0635: DNAME insist with synth-from-dnssec enabled
   https://kb.isc.org/docs/cve-2022-0635

   CVE-2022-0667: Assertion failure on delayed DS lookup
   https://kb.isc.org/docs/cve-2022-0667

New versions of BIND are available from https://www.isc.org/downloads

Operators and package maintainers who prefer to apply patches
selectively can find individual vulnerability-specific patches in the
"patches" subdirectory of the release directories for our three stable
release branches (9.11. 9.16 and 9.18)

   https://downloads.isc.org/isc/bind9/9.11.37/patches/
   https://downloads.isc.org/isc/bind9/9.16.27/patches/
   https://downloads.isc.org/isc/bind9/9.18.1/patches/

With the public announcement of these vulnerabilities, the embargo
period is ended and any updated software packages that have been
prepared may be released.
-- 
Everett B. Fulton
ISC Support

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.