[<prev] [day] [month] [year] [list]
Message-ID: <d4d74ff9-e45d-42e6-9c4f-bf8addd0eaf5@isc.org>
Date: Wed, 21 May 2025 14:26:20 +0200
From: Nicki Křížek <nicki@....org>
To: oss-security@...ts.openwall.com
Cc: security-officer@....org
Subject: CVE-2025-40775: BIND 9: DNS message with invalid TSIG causes an assertion failure
On 21 May 2025 we (Internet Systems Consortium) disclosed one vulnerability affecting our BIND 9 software:
- CVE-2025-40775: DNS message with invalid TSIG causes an assertion failure https://kb.isc.org/docs/cve-2025-40775
New versions of BIND 9 are available from https://www.isc.org/downloads
Operators and package maintainers who prefer to apply patches selectively can find individual vulnerability-specific patches in the "patches" subdirectory of each published release directory:
- https://downloads.isc.org/isc/bind9/9.20.9/patches/
- https://downloads.isc.org/isc/bind9/9.21.8/patches/
With the public announcement of these vulnerabilities, the embargo period is ended and any updated software packages that have been prepared may be released.
--
Nicki Křížek (they/them)
Download attachment "OpenPGP_0x01623B9B652A20A7.asc" of type "application/pgp-keys" (2412 bytes)
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (229 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
