csaf_suse - suse-su-2022:3767-1

Vulnerability from csaf_suse

Published

2022-10-26 09:49

Modified

2022-10-26 09:49

Summary

Recommended update for bind

Notes

Title of the patch

Recommended update for bind

Description of the patch

This update for bind fixes the following issues: Update to release 9.16.33: - CVE-2022-2795: Fixed potential performance degredation due to missing database lookup limits when processing large delegations (bsc#1203614). - CVE-2022-3080: Fixed assertion failure when there was a stale CNAME in the cache for the incoming query and the stale-answer-client-timeout option is set to 0 (bsc#1203618). - CVE-2022-38177: Fixed a memory leak that could be externally triggered in the DNSSEC verification code for the ECDSA algorithm (bsc#1203619). - CVE-2022-38178: Fixed memory leaks that could be externally triggered in the DNSSEC verification code for the EdDSA algorithm (bsc#1203620). - Add systemd drop-in directory for named service (bsc#1201689). - Add modified createNamedConfInclude script and README-bind.chrootenv (bsc#1203250). - Feature Changes: - Response Rate Limiting (RRL) code now treats all QNAMEs that are subject to wildcard processing within a given zone as the same name, to prevent circumventing the limits enforced by RRL. - Zones using dnssec-policy now require dynamic DNS or inline-signing to be configured explicitly. - A backward-compatible approach was implemented for encoding internationalized domain names (IDN) in dig and converting the domain to IDNA2008 form; if that fails, BIND tries an IDNA2003 conversion. - The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically disabled on systems where they are disallowed by the security policy. Primary zones using those algorithms need to be migrated to new algorithms prior to running on these systems, as graceful migration to different DNSSEC algorithms is not possible when RSASHA1 is disallowed by the operating system. - Log messages related to fetch limiting have been improved to provide more complete information. Specifically, the final counts of allowed and spilled fetches are now logged before the counter object is destroyed. - Non-dynamic zones that inherit dnssec-policy from the view or options blocks were not marked as inline-signed and therefore never scheduled to be re-signed. This has been fixed. - The old max-zone-ttl zone option was meant to be superseded by the max-zone-ttl option in dnssec-policy; however, the latter option was not fully effective. This has been corrected: zones no longer load if they contain TTLs greater than the limit configured in dnssec-policy. For zones with both the old max-zone-ttl option and dnssec-policy configured, the old option is ignored, and a warning is generated. - rndc dumpdb -expired was fixed to include expired RRsets, even if stale-cache-enable is set to no and the cache-cleaning time window has passed. (jsc#SLE-24600)

Patchnames

SUSE-2022-3767,SUSE-SLE-Module-Basesystem-15-SP4-2022-3767,SUSE-SLE-Module-Server-Applications-15-SP4-2022-3767,openSUSE-SLE-15.4-2022-3767

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Recommended update for bind",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for bind fixes the following issues:\n\nUpdate to release 9.16.33:\n\n- CVE-2022-2795: Fixed potential performance degredation due to missing database lookup limits when processing large delegations (bsc#1203614).\n- CVE-2022-3080: Fixed assertion failure when there was a stale CNAME in the cache for the incoming query and the stale-answer-client-timeout option is set to 0 (bsc#1203618).\n- CVE-2022-38177: Fixed a memory leak that could be externally triggered in the DNSSEC verification code for the ECDSA algorithm (bsc#1203619).\n- CVE-2022-38178: Fixed memory leaks that could be externally triggered in the DNSSEC verification code for the EdDSA algorithm (bsc#1203620).\n\n- Add systemd drop-in directory for named service (bsc#1201689).\n- Add modified createNamedConfInclude script and README-bind.chrootenv (bsc#1203250).\n\n- Feature Changes:\n  - Response Rate Limiting (RRL) code now treats all QNAMEs that are\n  subject to wildcard processing within a given zone as the same\n  name, to prevent circumventing the limits enforced by RRL.\n\n  - Zones using dnssec-policy now require dynamic DNS or\n  inline-signing to be configured explicitly.\n\n  - A backward-compatible approach was implemented for encoding\n  internationalized domain names (IDN) in dig and converting the\n  domain to IDNA2008 form; if that fails,\n  BIND tries an IDNA2003 conversion.\n\n  - The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically\n  disabled on systems where they are disallowed by the security policy.\n  Primary zones using those algorithms need to be migrated to new algorithms\n  prior to running on these systems, as graceful migration to different DNSSEC\n  algorithms is not possible when RSASHA1 is disallowed by the operating system.\n\n  - Log messages related to fetch limiting have been improved to provide\n  more complete information. Specifically, the final counts of allowed\n  and spilled fetches are now logged before the counter object is destroyed.\n\n  - Non-dynamic zones that inherit dnssec-policy from the view or options\n  blocks were not marked as inline-signed and therefore never scheduled\n  to be re-signed. This has been fixed.\n\n  - The old max-zone-ttl zone option was meant to be superseded by\n  the max-zone-ttl option in dnssec-policy; however, the latter option\n  was not fully effective. This has been corrected: zones no longer load\n  if they contain TTLs greater than the limit configured in dnssec-policy.\n  For zones with both the old max-zone-ttl option and dnssec-policy\n  configured, the old option is ignored, and a warning is generated.\n\n  - rndc dumpdb -expired was fixed to include expired RRsets,\n  even if stale-cache-enable is set to no and the cache-cleaning time \n  window has passed. (jsc#SLE-24600)\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-2022-3767,SUSE-SLE-Module-Basesystem-15-SP4-2022-3767,SUSE-SLE-Module-Server-Applications-15-SP4-2022-3767,openSUSE-SLE-15.4-2022-3767",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_3767-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2022:3767-1",
            url: "https://www.suse.com/support/update/announcement/2022/suse-su-20223767-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2022:3767-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2022-October/012698.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1201689",
            url: "https://bugzilla.suse.com/1201689",
         },
         {
            category: "self",
            summary: "SUSE Bug 1203250",
            url: "https://bugzilla.suse.com/1203250",
         },
         {
            category: "self",
            summary: "SUSE Bug 1203614",
            url: "https://bugzilla.suse.com/1203614",
         },
         {
            category: "self",
            summary: "SUSE Bug 1203618",
            url: "https://bugzilla.suse.com/1203618",
         },
         {
            category: "self",
            summary: "SUSE Bug 1203619",
            url: "https://bugzilla.suse.com/1203619",
         },
         {
            category: "self",
            summary: "SUSE Bug 1203620",
            url: "https://bugzilla.suse.com/1203620",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-2795 page",
            url: "https://www.suse.com/security/cve/CVE-2022-2795/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-3080 page",
            url: "https://www.suse.com/security/cve/CVE-2022-3080/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-38177 page",
            url: "https://www.suse.com/security/cve/CVE-2022-38177/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-38178 page",
            url: "https://www.suse.com/security/cve/CVE-2022-38178/",
         },
      ],
      title: "Recommended update for bind",
      tracking: {
         current_release_date: "2022-10-26T09:49:55Z",
         generator: {
            date: "2022-10-26T09:49:55Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2022:3767-1",
         initial_release_date: "2022-10-26T09:49:55Z",
         revision_history: [
            {
               date: "2022-10-26T09:49:55Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "bind-9.16.33-150400.5.11.1.aarch64",
                        product: {
                           name: "bind-9.16.33-150400.5.11.1.aarch64",
                           product_id: "bind-9.16.33-150400.5.11.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "bind-utils-9.16.33-150400.5.11.1.aarch64",
                        product: {
                           name: "bind-utils-9.16.33-150400.5.11.1.aarch64",
                           product_id: "bind-utils-9.16.33-150400.5.11.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "bind-9.16.33-150400.5.11.1.i586",
                        product: {
                           name: "bind-9.16.33-150400.5.11.1.i586",
                           product_id: "bind-9.16.33-150400.5.11.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "bind-utils-9.16.33-150400.5.11.1.i586",
                        product: {
                           name: "bind-utils-9.16.33-150400.5.11.1.i586",
                           product_id: "bind-utils-9.16.33-150400.5.11.1.i586",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "i586",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "bind-doc-9.16.33-150400.5.11.1.noarch",
                        product: {
                           name: "bind-doc-9.16.33-150400.5.11.1.noarch",
                           product_id: "bind-doc-9.16.33-150400.5.11.1.noarch",
                        },
                     },
                     {
                        category: "product_version",
                        name: "python3-bind-9.16.33-150400.5.11.1.noarch",
                        product: {
                           name: "python3-bind-9.16.33-150400.5.11.1.noarch",
                           product_id: "python3-bind-9.16.33-150400.5.11.1.noarch",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "bind-9.16.33-150400.5.11.1.ppc64le",
                        product: {
                           name: "bind-9.16.33-150400.5.11.1.ppc64le",
                           product_id: "bind-9.16.33-150400.5.11.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "bind-utils-9.16.33-150400.5.11.1.ppc64le",
                        product: {
                           name: "bind-utils-9.16.33-150400.5.11.1.ppc64le",
                           product_id: "bind-utils-9.16.33-150400.5.11.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "bind-9.16.33-150400.5.11.1.s390x",
                        product: {
                           name: "bind-9.16.33-150400.5.11.1.s390x",
                           product_id: "bind-9.16.33-150400.5.11.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "bind-utils-9.16.33-150400.5.11.1.s390x",
                        product: {
                           name: "bind-utils-9.16.33-150400.5.11.1.s390x",
                           product_id: "bind-utils-9.16.33-150400.5.11.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "bind-9.16.33-150400.5.11.1.x86_64",
                        product: {
                           name: "bind-9.16.33-150400.5.11.1.x86_64",
                           product_id: "bind-9.16.33-150400.5.11.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "bind-utils-9.16.33-150400.5.11.1.x86_64",
                        product: {
                           name: "bind-utils-9.16.33-150400.5.11.1.x86_64",
                           product_id: "bind-utils-9.16.33-150400.5.11.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
                        product: {
                           name: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
                           product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-module-basesystem:15:sp4",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Module for Server Applications 15 SP4",
                        product: {
                           name: "SUSE Linux Enterprise Module for Server Applications 15 SP4",
                           product_id: "SUSE Linux Enterprise Module for Server Applications 15 SP4",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-module-server-applications:15:sp4",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "openSUSE Leap 15.4",
                        product: {
                           name: "openSUSE Leap 15.4",
                           product_id: "openSUSE Leap 15.4",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:leap:15.4",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-utils-9.16.33-150400.5.11.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.aarch64",
            },
            product_reference: "bind-utils-9.16.33-150400.5.11.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-utils-9.16.33-150400.5.11.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
            },
            product_reference: "bind-utils-9.16.33-150400.5.11.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-utils-9.16.33-150400.5.11.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.s390x",
            },
            product_reference: "bind-utils-9.16.33-150400.5.11.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-utils-9.16.33-150400.5.11.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.x86_64",
            },
            product_reference: "bind-utils-9.16.33-150400.5.11.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-bind-9.16.33-150400.5.11.1.noarch as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-bind-9.16.33-150400.5.11.1.noarch",
            },
            product_reference: "python3-bind-9.16.33-150400.5.11.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Basesystem 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-9.16.33-150400.5.11.1.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.aarch64",
            },
            product_reference: "bind-9.16.33-150400.5.11.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-9.16.33-150400.5.11.1.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.ppc64le",
            },
            product_reference: "bind-9.16.33-150400.5.11.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-9.16.33-150400.5.11.1.s390x as component of SUSE Linux Enterprise Module for Server Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.s390x",
            },
            product_reference: "bind-9.16.33-150400.5.11.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-9.16.33-150400.5.11.1.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.x86_64",
            },
            product_reference: "bind-9.16.33-150400.5.11.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-doc-9.16.33-150400.5.11.1.noarch as component of SUSE Linux Enterprise Module for Server Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-doc-9.16.33-150400.5.11.1.noarch",
            },
            product_reference: "bind-doc-9.16.33-150400.5.11.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Server Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-9.16.33-150400.5.11.1.aarch64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.aarch64",
            },
            product_reference: "bind-9.16.33-150400.5.11.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-9.16.33-150400.5.11.1.ppc64le as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.ppc64le",
            },
            product_reference: "bind-9.16.33-150400.5.11.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-9.16.33-150400.5.11.1.s390x as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.s390x",
            },
            product_reference: "bind-9.16.33-150400.5.11.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-9.16.33-150400.5.11.1.x86_64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.x86_64",
            },
            product_reference: "bind-9.16.33-150400.5.11.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-doc-9.16.33-150400.5.11.1.noarch as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:bind-doc-9.16.33-150400.5.11.1.noarch",
            },
            product_reference: "bind-doc-9.16.33-150400.5.11.1.noarch",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-utils-9.16.33-150400.5.11.1.aarch64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.aarch64",
            },
            product_reference: "bind-utils-9.16.33-150400.5.11.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-utils-9.16.33-150400.5.11.1.ppc64le as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
            },
            product_reference: "bind-utils-9.16.33-150400.5.11.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-utils-9.16.33-150400.5.11.1.s390x as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.s390x",
            },
            product_reference: "bind-utils-9.16.33-150400.5.11.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "bind-utils-9.16.33-150400.5.11.1.x86_64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.x86_64",
            },
            product_reference: "bind-utils-9.16.33-150400.5.11.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-bind-9.16.33-150400.5.11.1.noarch as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:python3-bind-9.16.33-150400.5.11.1.noarch",
            },
            product_reference: "python3-bind-9.16.33-150400.5.11.1.noarch",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2022-2795",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-2795",
            },
         ],
         notes: [
            {
               category: "general",
               text: "By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.aarch64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.s390x",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.x86_64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-bind-9.16.33-150400.5.11.1.noarch",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.aarch64",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.ppc64le",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.s390x",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.x86_64",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-doc-9.16.33-150400.5.11.1.noarch",
               "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.aarch64",
               "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.ppc64le",
               "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.s390x",
               "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.x86_64",
               "openSUSE Leap 15.4:bind-doc-9.16.33-150400.5.11.1.noarch",
               "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.aarch64",
               "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
               "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.s390x",
               "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.x86_64",
               "openSUSE Leap 15.4:python3-bind-9.16.33-150400.5.11.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-2795",
               url: "https://www.suse.com/security/cve/CVE-2022-2795",
            },
            {
               category: "external",
               summary: "SUSE Bug 1203614 for CVE-2022-2795",
               url: "https://bugzilla.suse.com/1203614",
            },
            {
               category: "external",
               summary: "SUSE Bug 1205842 for CVE-2022-2795",
               url: "https://bugzilla.suse.com/1205842",
            },
            {
               category: "external",
               summary: "SUSE Bug 1209913 for CVE-2022-2795",
               url: "https://bugzilla.suse.com/1209913",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-bind-9.16.33-150400.5.11.1.noarch",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.x86_64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-doc-9.16.33-150400.5.11.1.noarch",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.aarch64",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.ppc64le",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.s390x",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.x86_64",
                  "openSUSE Leap 15.4:bind-doc-9.16.33-150400.5.11.1.noarch",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.aarch64",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.s390x",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.x86_64",
                  "openSUSE Leap 15.4:python3-bind-9.16.33-150400.5.11.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-bind-9.16.33-150400.5.11.1.noarch",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.x86_64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-doc-9.16.33-150400.5.11.1.noarch",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.aarch64",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.ppc64le",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.s390x",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.x86_64",
                  "openSUSE Leap 15.4:bind-doc-9.16.33-150400.5.11.1.noarch",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.aarch64",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.s390x",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.x86_64",
                  "openSUSE Leap 15.4:python3-bind-9.16.33-150400.5.11.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-10-26T09:49:55Z",
               details: "moderate",
            },
         ],
         title: "CVE-2022-2795",
      },
      {
         cve: "CVE-2022-3080",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-3080",
            },
         ],
         notes: [
            {
               category: "general",
               text: "By sending specific queries to the resolver, an attacker can cause named to crash.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.aarch64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.s390x",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.x86_64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-bind-9.16.33-150400.5.11.1.noarch",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.aarch64",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.ppc64le",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.s390x",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.x86_64",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-doc-9.16.33-150400.5.11.1.noarch",
               "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.aarch64",
               "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.ppc64le",
               "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.s390x",
               "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.x86_64",
               "openSUSE Leap 15.4:bind-doc-9.16.33-150400.5.11.1.noarch",
               "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.aarch64",
               "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
               "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.s390x",
               "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.x86_64",
               "openSUSE Leap 15.4:python3-bind-9.16.33-150400.5.11.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-3080",
               url: "https://www.suse.com/security/cve/CVE-2022-3080",
            },
            {
               category: "external",
               summary: "SUSE Bug 1203618 for CVE-2022-3080",
               url: "https://bugzilla.suse.com/1203618",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-bind-9.16.33-150400.5.11.1.noarch",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.x86_64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-doc-9.16.33-150400.5.11.1.noarch",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.aarch64",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.ppc64le",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.s390x",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.x86_64",
                  "openSUSE Leap 15.4:bind-doc-9.16.33-150400.5.11.1.noarch",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.aarch64",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.s390x",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.x86_64",
                  "openSUSE Leap 15.4:python3-bind-9.16.33-150400.5.11.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-bind-9.16.33-150400.5.11.1.noarch",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.x86_64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-doc-9.16.33-150400.5.11.1.noarch",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.aarch64",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.ppc64le",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.s390x",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.x86_64",
                  "openSUSE Leap 15.4:bind-doc-9.16.33-150400.5.11.1.noarch",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.aarch64",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.s390x",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.x86_64",
                  "openSUSE Leap 15.4:python3-bind-9.16.33-150400.5.11.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-10-26T09:49:55Z",
               details: "important",
            },
         ],
         title: "CVE-2022-3080",
      },
      {
         cve: "CVE-2022-38177",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-38177",
            },
         ],
         notes: [
            {
               category: "general",
               text: "By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.aarch64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.s390x",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.x86_64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-bind-9.16.33-150400.5.11.1.noarch",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.aarch64",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.ppc64le",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.s390x",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.x86_64",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-doc-9.16.33-150400.5.11.1.noarch",
               "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.aarch64",
               "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.ppc64le",
               "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.s390x",
               "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.x86_64",
               "openSUSE Leap 15.4:bind-doc-9.16.33-150400.5.11.1.noarch",
               "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.aarch64",
               "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
               "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.s390x",
               "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.x86_64",
               "openSUSE Leap 15.4:python3-bind-9.16.33-150400.5.11.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-38177",
               url: "https://www.suse.com/security/cve/CVE-2022-38177",
            },
            {
               category: "external",
               summary: "SUSE Bug 1203619 for CVE-2022-38177",
               url: "https://bugzilla.suse.com/1203619",
            },
            {
               category: "external",
               summary: "SUSE Bug 1204101 for CVE-2022-38177",
               url: "https://bugzilla.suse.com/1204101",
            },
            {
               category: "external",
               summary: "SUSE Bug 1205078 for CVE-2022-38177",
               url: "https://bugzilla.suse.com/1205078",
            },
            {
               category: "external",
               summary: "SUSE Bug 1205219 for CVE-2022-38177",
               url: "https://bugzilla.suse.com/1205219",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-bind-9.16.33-150400.5.11.1.noarch",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.x86_64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-doc-9.16.33-150400.5.11.1.noarch",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.aarch64",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.ppc64le",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.s390x",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.x86_64",
                  "openSUSE Leap 15.4:bind-doc-9.16.33-150400.5.11.1.noarch",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.aarch64",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.s390x",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.x86_64",
                  "openSUSE Leap 15.4:python3-bind-9.16.33-150400.5.11.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-bind-9.16.33-150400.5.11.1.noarch",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.x86_64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-doc-9.16.33-150400.5.11.1.noarch",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.aarch64",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.ppc64le",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.s390x",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.x86_64",
                  "openSUSE Leap 15.4:bind-doc-9.16.33-150400.5.11.1.noarch",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.aarch64",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.s390x",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.x86_64",
                  "openSUSE Leap 15.4:python3-bind-9.16.33-150400.5.11.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-10-26T09:49:55Z",
               details: "important",
            },
         ],
         title: "CVE-2022-38177",
      },
      {
         cve: "CVE-2022-38178",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-38178",
            },
         ],
         notes: [
            {
               category: "general",
               text: "By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.aarch64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.s390x",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.x86_64",
               "SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-bind-9.16.33-150400.5.11.1.noarch",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.aarch64",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.ppc64le",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.s390x",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.x86_64",
               "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-doc-9.16.33-150400.5.11.1.noarch",
               "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.aarch64",
               "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.ppc64le",
               "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.s390x",
               "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.x86_64",
               "openSUSE Leap 15.4:bind-doc-9.16.33-150400.5.11.1.noarch",
               "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.aarch64",
               "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
               "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.s390x",
               "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.x86_64",
               "openSUSE Leap 15.4:python3-bind-9.16.33-150400.5.11.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-38178",
               url: "https://www.suse.com/security/cve/CVE-2022-38178",
            },
            {
               category: "external",
               summary: "SUSE Bug 1203620 for CVE-2022-38178",
               url: "https://bugzilla.suse.com/1203620",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-bind-9.16.33-150400.5.11.1.noarch",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.x86_64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-doc-9.16.33-150400.5.11.1.noarch",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.aarch64",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.ppc64le",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.s390x",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.x86_64",
                  "openSUSE Leap 15.4:bind-doc-9.16.33-150400.5.11.1.noarch",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.aarch64",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.s390x",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.x86_64",
                  "openSUSE Leap 15.4:python3-bind-9.16.33-150400.5.11.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.aarch64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.s390x",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:bind-utils-9.16.33-150400.5.11.1.x86_64",
                  "SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-bind-9.16.33-150400.5.11.1.noarch",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.aarch64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.ppc64le",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.s390x",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-9.16.33-150400.5.11.1.x86_64",
                  "SUSE Linux Enterprise Module for Server Applications 15 SP4:bind-doc-9.16.33-150400.5.11.1.noarch",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.aarch64",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.ppc64le",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.s390x",
                  "openSUSE Leap 15.4:bind-9.16.33-150400.5.11.1.x86_64",
                  "openSUSE Leap 15.4:bind-doc-9.16.33-150400.5.11.1.noarch",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.aarch64",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.ppc64le",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.s390x",
                  "openSUSE Leap 15.4:bind-utils-9.16.33-150400.5.11.1.x86_64",
                  "openSUSE Leap 15.4:python3-bind-9.16.33-150400.5.11.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-10-26T09:49:55Z",
               details: "important",
            },
         ],
         title: "CVE-2022-38178",
      },
   ],
}

cve-2022-38178

Vulnerability from cvelistv5

Published

2022-09-21 10:15

Modified

2024-09-17 02:58

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

References

▼	URL	Tags
	https://kb.isc.org/docs/cve-2022-38178
	http://www.openwall.com/lists/oss-security/2022/09/21/3	mailing-list
	https://www.debian.org/security/2022/dsa-5235	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html	mailing-list
	https://security.gentoo.org/glsa/202210-25	vendor-advisory
	https://security.netapp.com/advisory/ntap-20221228-0009/

Impacted products

	Vendor	Product	Version
	ISC	BIND9	Version: Open Source Branch 9.9 9.9.12 through versions up to and including 9.9.13 Version: Open Source Branch 9.10 9.10.7 through versions up to and including 9.10.8 Version: Open Source Branches 9.11 through 9.16 9.11.3 through versions before 9.16.33 Version: Open Source Branch 9.18 9.18.0 through versions before 9.18.7 Version: Supported Preview Branch 9.11-S 9.11.4-S1 through versions up to and including 9.11.37-S1 Version: Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1 Version: Development Branch 9.19 9.19.0 through versions before 9.19.5

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:45:52.980Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kb.isc.org/docs/cve-2022-38178",
               },
               {
                  name: "[oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178)",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2022/09/21/3",
               },
               {
                  name: "DSA-5235",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5235",
               },
               {
                  name: "FEDORA-2022-ef038365de",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/",
               },
               {
                  name: "FEDORA-2022-8268735e06",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/",
               },
               {
                  name: "FEDORA-2022-b197d64471",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/",
               },
               {
                  name: "[debian-lts-announce] 20221005 [SECURITY] [DLA 3138-1] bind9 security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html",
               },
               {
                  name: "GLSA-202210-25",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202210-25",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20221228-0009/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "BIND9",
               vendor: "ISC",
               versions: [
                  {
                     status: "affected",
                     version: "Open Source Branch 9.9 9.9.12 through versions up to and including 9.9.13",
                  },
                  {
                     status: "affected",
                     version: "Open Source Branch 9.10 9.10.7 through versions up to and including 9.10.8",
                  },
                  {
                     status: "affected",
                     version: "Open Source Branches 9.11 through 9.16 9.11.3 through versions before 9.16.33",
                  },
                  {
                     status: "affected",
                     version: "Open Source Branch 9.18 9.18.0 through versions before 9.18.7",
                  },
                  {
                     status: "affected",
                     version: "Supported Preview Branch 9.11-S 9.11.4-S1 through versions up to and including 9.11.37-S1",
                  },
                  {
                     status: "affected",
                     version: "Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1",
                  },
                  {
                     status: "affected",
                     version: "Development Branch 9.19 9.19.0 through versions before 9.19.5",
                  },
               ],
            },
         ],
         datePublic: "2022-09-21T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.",
            },
         ],
         exploits: [
            {
               lang: "en",
               value: "This flaw was discovered in internal testing. We are not aware of any active exploits.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.16.32, 9.18.0 -> 9.18.6, versions 9.11.4-S1 -> 9.11.37-S1, 9.16.8-S1 -> 9.16.32-S1 of the BIND Supported Preview Edition, and versions 9.19.0 -> 9.19.4 of the BIND 9.19 development branch, the DNSSEC verification code for the EdDSA algorithm leaks memory when there is a signature length mismatch.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-12-28T00:00:00",
            orgId: "404fd4d2-a609-4245-b543-2c944a302a22",
            shortName: "isc",
         },
         references: [
            {
               url: "https://kb.isc.org/docs/cve-2022-38178",
            },
            {
               name: "[oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178)",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2022/09/21/3",
            },
            {
               name: "DSA-5235",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2022/dsa-5235",
            },
            {
               name: "FEDORA-2022-ef038365de",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/",
            },
            {
               name: "FEDORA-2022-8268735e06",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/",
            },
            {
               name: "FEDORA-2022-b197d64471",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/",
            },
            {
               name: "[debian-lts-announce] 20221005 [SECURITY] [DLA 3138-1] bind9 security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html",
            },
            {
               name: "GLSA-202210-25",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202210-25",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20221228-0009/",
            },
         ],
         solutions: [
            {
               lang: "en",
               value: "Upgrade to the patched release most closely related to your current version of BIND: BIND 9.16.33, BIND 9.18.7, BIND 9.19.5, or for BIND Supported Preview Edition (a special feature preview branch of BIND provided to eligible ISC support customers): BIND 9.16.33-S1.",
            },
         ],
         source: {
            discovery: "INTERNAL",
         },
         title: "Memory leaks in EdDSA DNSSEC verification code",
         workarounds: [
            {
               lang: "en",
               value: "Disable the following algorithms in your configuration using the disable-algorithms option: ED25519, ED448. Note that this causes zones signed with these algorithms to be treated as insecure.",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "404fd4d2-a609-4245-b543-2c944a302a22",
      assignerShortName: "isc",
      cveId: "CVE-2022-38178",
      datePublished: "2022-09-21T10:15:29.078642Z",
      dateReserved: "2022-08-12T00:00:00",
      dateUpdated: "2024-09-17T02:58:12.991Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-2795

Vulnerability from cvelistv5

Published

2022-09-21 10:15

Modified

2024-11-29 12:04

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.

References

▼	URL	Tags
	https://kb.isc.org/docs/cve-2022-2795
	http://www.openwall.com/lists/oss-security/2022/09/21/3	mailing-list
	https://www.debian.org/security/2022/dsa-5235	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html	mailing-list
	https://security.gentoo.org/glsa/202210-25	vendor-advisory

Impacted products

	Vendor	Product	Version
	ISC	BIND9	Version: Open Source Branches 9.0 through 9.16 9.0.0 through versions before 9.16.33 Version: Open Source Branch 9.18 9.18.0 through versions before 9.18.7 Version: Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions up to and including 9.11.37-S1 Version: Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1 Version: Development Branch 9.19 9.19.0 through versions before 9.19.5

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:isc:bind:9.0.0:-:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "bind",
                  vendor: "isc",
                  versions: [
                     {
                        lessThanOrEqual: "9.16.32",
                        status: "affected",
                        version: "9.0.0",
                        versionType: "custom",
                     },
                  ],
               },
               {
                  cpes: [
                     "cpe:2.3:a:isc:bind:9.9.3:s1:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "bind",
                  vendor: "isc",
                  versions: [
                     {
                        lessThan: "9.11.37",
                        status: "affected",
                        version: "9.9.3",
                        versionType: "custom",
                     },
                  ],
               },
               {
                  cpes: [
                     "cpe:2.3:a:isc:bind:9.16.8:s1:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "bind",
                  vendor: "isc",
                  versions: [
                     {
                        lessThan: "9.16.32",
                        status: "affected",
                        version: "9.16.8",
                        versionType: "custom",
                     },
                  ],
               },
               {
                  cpes: [
                     "cpe:2.3:a:isc:bind:9.19.0:*:*:*:-:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "bind",
                  vendor: "isc",
                  versions: [
                     {
                        lessThan: "9.19.4",
                        status: "affected",
                        version: "9.19.0",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-2795",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-04-12T17:20:53.564264Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-20T19:41:53.934Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-11-29T12:04:33.614Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kb.isc.org/docs/cve-2022-2795",
               },
               {
                  name: "[oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178)",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2022/09/21/3",
               },
               {
                  name: "DSA-5235",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5235",
               },
               {
                  name: "FEDORA-2022-ef038365de",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/",
               },
               {
                  name: "FEDORA-2022-8268735e06",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/",
               },
               {
                  name: "FEDORA-2022-b197d64471",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/",
               },
               {
                  name: "[debian-lts-announce] 20221005 [SECURITY] [DLA 3138-1] bind9 security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html",
               },
               {
                  name: "GLSA-202210-25",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202210-25",
               },
               {
                  url: "https://security.netapp.com/advisory/ntap-20241129-0002/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "BIND9",
               vendor: "ISC",
               versions: [
                  {
                     status: "affected",
                     version: "Open Source Branches 9.0 through 9.16 9.0.0 through versions before 9.16.33",
                  },
                  {
                     status: "affected",
                     version: "Open Source Branch 9.18 9.18.0 through versions before 9.18.7",
                  },
                  {
                     status: "affected",
                     version: "Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions up to and including 9.11.37-S1",
                  },
                  {
                     status: "affected",
                     version: "Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1",
                  },
                  {
                     status: "affected",
                     version: "Development Branch 9.19 9.19.0 through versions before 9.19.5",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "ISC would like to thank Yehuda Afek from Tel-Aviv University and Anat Bremler-Barr & Shani Stajnrod from Reichman University for bringing this vulnerability to our attention.",
            },
         ],
         datePublic: "2022-09-21T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.",
            },
         ],
         exploits: [
            {
               lang: "en",
               value: "We are not aware of any active exploits.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "In BIND 9.0.0 -> 9.16.32, 9.18.0 -> 9.18.6, versions 9.9.3-S1 -> 9.11.37-S1, 9.16.8-S1 -> 9.16.32-S1 of the BIND Supported Preview Edition, and versions 9.19.0 -> 9.19.4 of the BIND 9.19 development branch, a flaw in resolver code can cause named to spend excessive amounts of time on processing large delegations.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-10-31T00:00:00",
            orgId: "404fd4d2-a609-4245-b543-2c944a302a22",
            shortName: "isc",
         },
         references: [
            {
               url: "https://kb.isc.org/docs/cve-2022-2795",
            },
            {
               name: "[oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178)",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2022/09/21/3",
            },
            {
               name: "DSA-5235",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2022/dsa-5235",
            },
            {
               name: "FEDORA-2022-ef038365de",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/",
            },
            {
               name: "FEDORA-2022-8268735e06",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/",
            },
            {
               name: "FEDORA-2022-b197d64471",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/",
            },
            {
               name: "[debian-lts-announce] 20221005 [SECURITY] [DLA 3138-1] bind9 security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html",
            },
            {
               name: "GLSA-202210-25",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202210-25",
            },
         ],
         solutions: [
            {
               lang: "en",
               value: "Upgrade to the patched release most closely related to your current version of BIND: BIND 9.16.33, BIND 9.18.7, BIND 9.19.5, or for BIND Supported Preview Edition (a special feature preview branch of BIND provided to eligible ISC support customers): BIND 9.16.33-S1.",
            },
         ],
         source: {
            discovery: "EXTERNAL",
         },
         title: "Processing large delegations may severely degrade resolver performance",
         workarounds: [
            {
               lang: "en",
               value: "No workarounds known.",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "404fd4d2-a609-4245-b543-2c944a302a22",
      assignerShortName: "isc",
      cveId: "CVE-2022-2795",
      datePublished: "2022-09-21T10:15:25.796304Z",
      dateReserved: "2022-08-12T00:00:00",
      dateUpdated: "2024-11-29T12:04:33.614Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-38177

Vulnerability from cvelistv5

Published

2022-09-21 10:15

Modified

2024-09-17 00:06

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

References

▼	URL	Tags
	https://kb.isc.org/docs/cve-2022-38177
	http://www.openwall.com/lists/oss-security/2022/09/21/3	mailing-list
	https://www.debian.org/security/2022/dsa-5235	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html	mailing-list
	https://security.gentoo.org/glsa/202210-25	vendor-advisory
	https://security.netapp.com/advisory/ntap-20221228-0010/

Impacted products

	Vendor	Product	Version
	ISC	BIND9	Version: Open Source Branches 9.8 through 9.16 9.8.4 through versions before 9.16.33 Version: Supported Preview Branches 9.9-S through 9.11-S 9.9.4-S1 through versions up to and including 9.11.37-S1 Version: Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:45:52.975Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kb.isc.org/docs/cve-2022-38177",
               },
               {
                  name: "[oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178)",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2022/09/21/3",
               },
               {
                  name: "DSA-5235",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5235",
               },
               {
                  name: "FEDORA-2022-ef038365de",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/",
               },
               {
                  name: "FEDORA-2022-8268735e06",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/",
               },
               {
                  name: "FEDORA-2022-b197d64471",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/",
               },
               {
                  name: "[debian-lts-announce] 20221005 [SECURITY] [DLA 3138-1] bind9 security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html",
               },
               {
                  name: "GLSA-202210-25",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202210-25",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20221228-0010/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "BIND9",
               vendor: "ISC",
               versions: [
                  {
                     status: "affected",
                     version: "Open Source Branches 9.8 through 9.16 9.8.4 through versions before 9.16.33",
                  },
                  {
                     status: "affected",
                     version: "Supported Preview Branches 9.9-S through 9.11-S 9.9.4-S1 through versions up to and including 9.11.37-S1",
                  },
                  {
                     status: "affected",
                     version: "Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1",
                  },
               ],
            },
         ],
         datePublic: "2022-09-21T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.",
            },
         ],
         exploits: [
            {
               lang: "en",
               value: "This flaw was discovered in internal testing. We are not aware of any active exploits.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "In BIND 9.8.4 -> 9.16.32 and versions 9.9.4-S1 -> 9.11.37-S1, 9.16.8-S1 -> 9.16.32-S1 of the BIND Supported Preview Edition, the DNSSEC verification code for the ECDSA algorithm leaks memory when there is a signature length mismatch.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-12-28T00:00:00",
            orgId: "404fd4d2-a609-4245-b543-2c944a302a22",
            shortName: "isc",
         },
         references: [
            {
               url: "https://kb.isc.org/docs/cve-2022-38177",
            },
            {
               name: "[oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178)",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2022/09/21/3",
            },
            {
               name: "DSA-5235",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2022/dsa-5235",
            },
            {
               name: "FEDORA-2022-ef038365de",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/",
            },
            {
               name: "FEDORA-2022-8268735e06",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/",
            },
            {
               name: "FEDORA-2022-b197d64471",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/",
            },
            {
               name: "[debian-lts-announce] 20221005 [SECURITY] [DLA 3138-1] bind9 security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html",
            },
            {
               name: "GLSA-202210-25",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202210-25",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20221228-0010/",
            },
         ],
         solutions: [
            {
               lang: "en",
               value: "Upgrade to the patched release most closely related to your current version of BIND: BIND 9.16.33, or for BIND Supported Preview Edition (a special feature preview branch of BIND provided to eligible ISC support customers): BIND 9.16.33-S1.",
            },
         ],
         source: {
            discovery: "INTERNAL",
         },
         title: "Memory leak in ECDSA DNSSEC verification code",
         workarounds: [
            {
               lang: "en",
               value: "Disable the following algorithms in your configuration using the disable-algorithms option: ECDSAP256SHA256, ECDSAP384SHA384. Note that this causes zones signed with these algorithms to be treated as insecure.",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "404fd4d2-a609-4245-b543-2c944a302a22",
      assignerShortName: "isc",
      cveId: "CVE-2022-38177",
      datePublished: "2022-09-21T10:15:28.292139Z",
      dateReserved: "2022-08-12T00:00:00",
      dateUpdated: "2024-09-17T00:06:02.235Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-3080

Vulnerability from cvelistv5

Published

2022-09-21 10:15

Modified

2024-09-17 01:56

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

By sending specific queries to the resolver, an attacker can cause named to crash.

References

▼	URL	Tags
	https://kb.isc.org/docs/cve-2022-3080
	http://www.openwall.com/lists/oss-security/2022/09/21/3	mailing-list
	https://www.debian.org/security/2022/dsa-5235	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/	vendor-advisory
	https://security.gentoo.org/glsa/202210-25	vendor-advisory
	https://security.netapp.com/advisory/ntap-20240621-0002/

Impacted products

	Vendor	Product	Version
	ISC	BIND9	Version: Open Source Branch 9.16 9.16.14 through versions before 9.16.33 Version: Open Source Branch 9.18 9.18.0 through versions before 9.18.7 Version: Supported Preview Branch 9.16-S 9.16.14-S1 through versions before 9.16.33-S1 Version: Development Branch 9.19 9.19.0 through versions before 9.19.5

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "fedora",
                  vendor: "fedoraproject",
                  versions: [
                     {
                        status: "affected",
                        version: "35",
                     },
                  ],
               },
               {
                  cpes: [
                     "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "fedora",
                  vendor: "fedoraproject",
                  versions: [
                     {
                        status: "affected",
                        version: "36",
                     },
                  ],
               },
               {
                  cpes: [
                     "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "fedora",
                  vendor: "fedoraproject",
                  versions: [
                     {
                        status: "affected",
                        version: "37",
                     },
                  ],
               },
               {
                  cpes: [
                     "cpe:2.3:a:isc:bind:9.16.14:-:*:*:*:*:*:*",
                     "cpe:2.3:a:isc:bind:9.16.14:s1:*:*:supported_preview:*:*:*",
                     "cpe:2.3:a:isc:bind:9.16.21:s1:*:*:supported_preview:*:*:*",
                     "cpe:2.3:a:isc:bind:9.16.32:s1:*:*:supported_preview:*:*:*",
                     "cpe:2.3:a:isc:bind:9.18.0:*:*:*:-:*:*:*",
                     "cpe:2.3:a:isc:bind:9.19.0:*:*:*:-:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "bind",
                  vendor: "isc",
                  versions: [
                     {
                        lessThan: "9.16.33",
                        status: "affected",
                        version: "9.16.14",
                        versionType: "custom",
                     },
                     {
                        status: "affected",
                        version: "9.16.14",
                     },
                     {
                        status: "affected",
                        version: "9.16.21",
                     },
                     {
                        status: "affected",
                        version: "9.16.32",
                     },
                     {
                        lessThan: "9.18.7",
                        status: "affected",
                        version: "9.18.0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "9.19.5",
                        status: "affected",
                        version: "9.19.0",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-3080",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-06-26T19:18:15.810751Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-613",
                        description: "CWE-613 Insufficient Session Expiration",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-07-01T18:41:59.985Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T01:00:10.486Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kb.isc.org/docs/cve-2022-3080",
               },
               {
                  name: "[oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178)",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2022/09/21/3",
               },
               {
                  name: "DSA-5235",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5235",
               },
               {
                  name: "FEDORA-2022-ef038365de",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/",
               },
               {
                  name: "FEDORA-2022-8268735e06",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/",
               },
               {
                  name: "FEDORA-2022-b197d64471",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/",
               },
               {
                  name: "GLSA-202210-25",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202210-25",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20240621-0002/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "BIND9",
               vendor: "ISC",
               versions: [
                  {
                     status: "affected",
                     version: "Open Source Branch 9.16 9.16.14 through versions before 9.16.33",
                  },
                  {
                     status: "affected",
                     version: "Open Source Branch 9.18 9.18.0 through versions before 9.18.7",
                  },
                  {
                     status: "affected",
                     version: "Supported Preview Branch 9.16-S 9.16.14-S1 through versions before 9.16.33-S1",
                  },
                  {
                     status: "affected",
                     version: "Development Branch 9.19 9.19.0 through versions before 9.19.5",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "ISC would like to thank Maksym Odinintsev for bringing this vulnerability to our attention.",
            },
         ],
         datePublic: "2022-09-21T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "By sending specific queries to the resolver, an attacker can cause named to crash.",
            },
         ],
         exploits: [
            {
               lang: "en",
               value: "We are not aware of any active exploits.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "In BIND 9.16.14 -> 9.16.32, 9.18.0 -> 9.18.6, versions 9.16.14-S1 -> 9.16.32-S1 of the BIND Supported Preview Edition, and versions 9.19.0 -> 9.19.4 of the BIND 9.19 development branch, a BIND 9 resolver can crash when stale cache and stale answers are enabled, option stale-answer-client-timeout is set to 0 and there is a stale CNAME in the cache for an incoming query.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-06-21T19:08:09.899226",
            orgId: "404fd4d2-a609-4245-b543-2c944a302a22",
            shortName: "isc",
         },
         references: [
            {
               url: "https://kb.isc.org/docs/cve-2022-3080",
            },
            {
               name: "[oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178)",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2022/09/21/3",
            },
            {
               name: "DSA-5235",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2022/dsa-5235",
            },
            {
               name: "FEDORA-2022-ef038365de",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/",
            },
            {
               name: "FEDORA-2022-8268735e06",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/",
            },
            {
               name: "FEDORA-2022-b197d64471",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/",
            },
            {
               name: "GLSA-202210-25",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202210-25",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20240621-0002/",
            },
         ],
         solutions: [
            {
               lang: "en",
               value: "Upgrade to the patched release most closely related to your current version of BIND: BIND 9.16.33, BIND 9.18.7, BIND 9.19.5, or for BIND Supported Preview Edition (a special feature preview branch of BIND provided to eligible ISC support customers): BIND 9.16.33-S1.",
            },
         ],
         source: {
            discovery: "EXTERNAL",
         },
         title: "BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly",
         workarounds: [
            {
               lang: "en",
               value: "Setting stale-answer-client-timeout to off or to an integer greater than 0 will prevent BIND from crashing due to this issue.",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "404fd4d2-a609-4245-b543-2c944a302a22",
      assignerShortName: "isc",
      cveId: "CVE-2022-3080",
      datePublished: "2022-09-21T10:15:29.861874Z",
      dateReserved: "2022-09-01T00:00:00",
      dateUpdated: "2024-09-17T01:56:40.440Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_suse

cve-2022-38178

Vulnerability from cvelistv5

cve-2022-2795

Vulnerability from cvelistv5

cve-2022-38177

Vulnerability from cvelistv5

cve-2022-3080

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature