github - ghsa-mmmq-7jwv-j64j

ghsa-mmmq-7jwv-j64j

Vulnerability from github

Published

2022-03-23 00:00

Modified

2022-03-29 00:01

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

When the vulnerability is triggered the BIND process will exit. BIND 9.18.0

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-0667"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-617"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-03-22T12:15:00Z",
    "severity": "HIGH"
  },
  "details": "When the vulnerability is triggered the BIND process will exit. BIND 9.18.0",
  "id": "GHSA-mmmq-7jwv-j64j",
  "modified": "2022-03-29T00:01:23Z",
  "published": "2022-03-23T00:00:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0667"
    },
    {
      "type": "WEB",
      "url": "https://kb.isc.org/v1/docs/cve-2022-0667"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20220408-0001"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

cve-2022-0667

Vulnerability from cvelistv5

Published

2022-03-22 11:15

Modified

2024-09-16 22:20

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

Assertion failure on delayed DS lookup

References

▼	URL	Tags
	https://kb.isc.org/v1/docs/cve-2022-0667	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-20220408-0001/	x_refsource_CONFIRM

Impacted products

▼	Vendor	Product
	ISC	BIND

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:32:46.517Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kb.isc.org/v1/docs/cve-2022-0667"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220408-0001/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "all"
          ],
          "product": "BIND",
          "vendor": "ISC",
          "versions": [
            {
              "status": "affected",
              "version": "9.18.0"
            }
          ]
        }
      ],
      "datePublic": "2022-03-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "When the vulnerability is triggered the BIND process will exit. BIND 9.18.0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "In BIND 9.18.0 the recursive client code was refactored. This refactoring introduced a \"backstop lifetime timer\".  While BIND is processing a request for a DS record that needs to be forwarded, it waits until this processing is complete or until the backstop lifetime timer has timed out. When the resume_dslookup() function is called as a result of such a timeout, the function does not test whether the fetch has previously been shut down. This introduces the possibility of triggering an assertion failure, which could cause the BIND process to terminate.  Only the BIND 9.18 branch is affected. BIND 9.18.0",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-08T22:06:15",
        "orgId": "404fd4d2-a609-4245-b543-2c944a302a22",
        "shortName": "isc"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kb.isc.org/v1/docs/cve-2022-0667"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220408-0001/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Users of BIND 9.18.0 should upgrade to BIND 9.18.1"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Assertion failure on delayed DS lookup",
      "workarounds": [
        {
          "lang": "en",
          "value": "No workarounds known."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-officer@isc.org",
          "DATE_PUBLIC": "2022-03-16T19:00:00.000Z",
          "ID": "CVE-2022-0667",
          "STATE": "PUBLIC",
          "TITLE": "Assertion failure on delayed DS lookup"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "BIND",
                      "version": {
                        "version_data": [
                          {
                            "platform": "all",
                            "version_affected": "=",
                            "version_name": "9.18.0",
                            "version_value": "9.18.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ISC"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "When the vulnerability is triggered the BIND process will exit. BIND 9.18.0"
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "In BIND 9.18.0 the recursive client code was refactored. This refactoring introduced a \"backstop lifetime timer\".  While BIND is processing a request for a DS record that needs to be forwarded, it waits until this processing is complete or until the backstop lifetime timer has timed out. When the resume_dslookup() function is called as a result of such a timeout, the function does not test whether the fetch has previously been shut down. This introduces the possibility of triggering an assertion failure, which could cause the BIND process to terminate.  Only the BIND 9.18 branch is affected. BIND 9.18.0"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://kb.isc.org/v1/docs/cve-2022-0667",
              "refsource": "CONFIRM",
              "url": "https://kb.isc.org/v1/docs/cve-2022-0667"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220408-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220408-0001/"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Users of BIND 9.18.0 should upgrade to BIND 9.18.1"
          }
        ],
        "source": {
          "discovery": "INTERNAL"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "No workarounds known."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22",
    "assignerShortName": "isc",
    "cveId": "CVE-2022-0667",
    "datePublished": "2022-03-22T11:15:13.972441Z",
    "dateReserved": "2022-02-17T00:00:00",
    "dateUpdated": "2024-09-16T22:20:53.204Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted