<!--X-Body-Begin-->
<!--X-User-Header-->
oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->
By Date
By Thread
</form>
<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
Two vulnerabilities disclosed in BIND (CVE-2020-8616 and CVE-2020-8617)
<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->
From: ISC Security Officer <security-officer () isc org>
Date: Tue, 19 May 2020 01:16:04 -0800
<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->
<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
On May 19, 2020, Internet Systems Consortium have disclosed two
vulnerabilities in our BIND 9 software:
CVE-2020-8616: BIND does not sufficiently limit the number
of fetches performed when processing referrals
https://kb.isc.org/docs/cve-2020-8616
CVE-2020-8617: A logic error in code which checks TSIG
validity can be used to trigger an assertion failure in tsig.c
https://kb.isc.org/docs/cve-2020-8617
With the public announcement of these vulnerabilities, the embargo
period is ended and any updated software packages that have been
prepared may be released.
ISC's own releases containing fixes are:
- BIND 9.11.19
- BIND 9.14.12
- BIND 9.16.3
each of which can be downloaded via the ISC downloads page,
https://www.isc.org/downloads
For package maintainers who want *only* the fixes for the
CVE vulnerabilities, patch diffs are available for each branch
in the "patches" subdirectory of the branch's May 2020
maintenance release, e.g.:
9.11 branch: https://downloads.isc.org/isc/bind9/9.11.19/patches
9.14 branch: https://downloads.isc.org/isc/bind9/9.14.12/patches
9.16 branch: https://downloads.isc.org/isc/bind9/9.16.3/patches
Sincerely,
Michael McNally
ISC Security Officer
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->
By Date
By Thread
Current thread:
Two vulnerabilities disclosed in BIND (CVE-2020-8616 and CVE-2020-8617) ISC Security Officer (May 19)
<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->