NA

CVE-2023-2911

Published: 21/06/2023 Updated: 03/07/2023
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 0

Vulnerability Summary

If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33 up to and including 9.16.41, 9.18.7 up to and including 9.18.15, 9.16.33-S1 up to and including 9.16.41-S1, and 9.18.11-S1 up to and including 9.18.15-S1.

Vulnerable Product Search on Vulmon Subscribe to Product

isc bind

debian debian linux 11.0

debian debian linux 12.0

fedoraproject fedora 37

fedoraproject fedora 38

netapp active iq unified manager -

netapp h700s_firmware -

netapp h300s_firmware -

netapp h410c_firmware -

netapp h410s_firmware -

netapp h500s_firmware -

Vendor Advisories

Several vulnerabilities were discovered in BIND, a DNS server implementation CVE-2023-2828 Shoham Danino, Anat Bremler-Barr, Yehuda Afek and Yuval Shavitt discovered that a flaw in the cache-cleaning algorithm used in named can cause that named's configured cache size limit can be significantly exceeded, potentially resulting in d ...
Description<!----> This CVE is under investigation by Red Hat Product Security ...