Vulnerabilities > CVE-2019-6477 - Resource Exhaustion vulnerability in multiple products

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
isc
fedoraproject
CWE-400
nessus
NVD
Published: 2019-11-26
Updated: 2024-11-21

Summary

With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server releasing these multiple resources can cause it to become unresponsive, even for queries that can be answered authoritatively or from cache. (This is most likely to be perceived as an intermittent server problem).

Vulnerable Configurations

Part Description Count
Application
Isc
27
OS
Fedoraproject
2

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • XML Ping of the Death
    An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
  • XML Entity Expansion
    An attacker submits an XML document to a target application where the XML document uses nested entity expansion to produce an excessively large output XML. XML allows the definition of macro-like structures that can be used to simplify the creation of complex structures. However, this capability can be abused to create excessive demands on a processor's CPU and memory. A small number of nested expansions can result in an exponential growth in demands on memory.
  • Inducing Account Lockout
    An attacker leverages the security functionality of the system aimed at thwarting potential attacks to launch a denial of service attack against a legitimate system user. Many systems, for instance, implement a password throttling mechanism that locks an account after a certain number of incorrect log in attempts. An attacker can leverage this throttling mechanism to lock a legitimate user out of their own account. The weakness that is being leveraged by an attacker is the very security feature that has been put in place to counteract attacks.
  • Violating Implicit Assumptions Regarding XML Content (aka XML Denial of Service (XDoS))
    XML Denial of Service (XDoS) can be applied to any technology that utilizes XML data. This is, of course, most distributed systems technology including Java, .Net, databases, and so on. XDoS is most closely associated with web services, SOAP, and Rest, because remote service requesters can post malicious XML payloads to the service provider designed to exhaust the service provider's memory, CPU, and/or disk space. The main weakness in XDoS is that the service provider generally must inspect, parse, and validate the XML messages to determine routing, workflow, security considerations, and so on. It is exactly these inspection, parsing, and validation routines that XDoS targets. There are three primary attack vectors that XDoS can navigate Target CPU through recursion: attacker creates a recursive payload and sends to service provider Target memory through jumbo payloads: service provider uses DOM to parse XML. DOM creates in memory representation of XML document, but when document is very large (for example, north of 1 Gb) service provider host may exhaust memory trying to build memory objects. XML Ping of death: attack service provider with numerous small files that clog the system. All of the above attacks exploit the loosely coupled nature of web services, where the service provider has little to no control over the service requester and any messages the service requester sends.

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4689.NASL
    descriptionSeveral vulnerabilities were discovered in BIND, a DNS server implementation. - CVE-2019-6477 It was discovered that TCP-pipelined queries can bypass tcp-client limits resulting in denial of service. - CVE-2020-8616 It was discovered that BIND does not sufficiently limit the number of fetches performed when processing referrals. An attacker can take advantage of this flaw to cause a denial of service (performance degradation) or use the recursing server in a reflection attack with a high amplification factor. - CVE-2020-8617 It was discovered that a logic error in the code which checks TSIG validity can be used to trigger an assertion failure, resulting in denial of service.
    last seen2020-05-31
    modified2020-05-20
    plugin id136721
    published2020-05-20
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136721
    titleDebian DSA-4689-1 : bind9 - security update
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-4689. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(136721);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/26");

  script_cve_id("CVE-2019-6477", "CVE-2020-8616", "CVE-2020-8617");
  script_xref(name:"DSA", value:"4689");
  script_xref(name:"IAVA", value:"2020-A-0217-S");

  script_name(english:"Debian DSA-4689-1 : bind9 - security update");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis",
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description",
    value:
"Several vulnerabilities were discovered in BIND, a DNS server
implementation.

  - CVE-2019-6477
    It was discovered that TCP-pipelined queries can bypass
    tcp-client limits resulting in denial of service.

  - CVE-2020-8616
    It was discovered that BIND does not sufficiently limit
    the number of fetches performed when processing
    referrals. An attacker can take advantage of this flaw
    to cause a denial of service (performance degradation)
    or use the recursing server in a reflection attack with
    a high amplification factor.

  - CVE-2020-8617
    It was discovered that a logic error in the code which
    checks TSIG validity can be used to trigger an assertion
    failure, resulting in denial of service."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=945171"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2019-6477"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2020-8616"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2020-8617"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/source-package/bind9"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://packages.debian.org/source/stretch/bind9"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://packages.debian.org/source/buster/bind9"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2020/dsa-4689"
  );
  script_set_attribute(
    attribute:"solution",
    value:
"Upgrade the bind9 packages.

For the oldstable distribution (stretch), these problems have been
fixed in version 1:9.10.3.dfsg.P4-12.3+deb9u6.

For the stable distribution (buster), these problems have been fixed
in version 1:9.11.5.P4+dfsg-5.1+deb10u1."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-8617");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:bind9");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:10.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:9.0");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/11/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/05/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/05/20");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"10.0", prefix:"bind9", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"bind9-doc", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"bind9-host", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"bind9utils", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"dnsutils", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"libbind-dev", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"libbind-export-dev", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"libbind9-161", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"libdns-export1104", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"libdns-export1104-udeb", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"libdns1104", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"libirs-export161", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"libirs-export161-udeb", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"libirs161", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"libisc-export1100", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"libisc-export1100-udeb", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"libisc1100", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"libisccc-export161", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"libisccc-export161-udeb", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"libisccc161", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"libisccfg-export163", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"libisccfg-export163-udeb", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"libisccfg163", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"10.0", prefix:"liblwres161", reference:"1:9.11.5.P4+dfsg-5.1+deb10u1")) flag++;
if (deb_check(release:"9.0", prefix:"bind9", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"bind9-doc", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"bind9-host", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"bind9utils", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"dnsutils", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"host", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"libbind-dev", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"libbind-export-dev", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"libbind9-140", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"libdns-export162", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"libdns-export162-udeb", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"libdns162", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"libirs-export141", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"libirs-export141-udeb", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"libirs141", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"libisc-export160", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"libisc-export160-udeb", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"libisc160", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"libisccc-export140", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"libisccc-export140-udeb", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"libisccc140", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"libisccfg-export140", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"libisccfg-export140-udeb", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"libisccfg140", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"liblwres141", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;
if (deb_check(release:"9.0", prefix:"lwresd", reference:"1:9.10.3.dfsg.P4-12.3+deb9u6")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4197-1.NASL
    descriptionIt was discovered that Bind incorrectly handled certain TCP-pipelined queries. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id131225
    published2019-11-22
    reporterUbuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131225
    titleUbuntu 18.04 LTS / 19.04 / 19.10 : bind9 vulnerability (USN-4197-1)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-4197-1. The text 
# itself is copyright (C) Canonical, Inc. See 
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
# trademark of Canonical, Inc.
#

include("compat.inc");

if (description)
{
  script_id(131225);
  script_version("1.4");
  script_cvs_date("Date: 2019/12/20");

  script_cve_id("CVE-2019-6477");
  script_xref(name:"USN", value:"4197-1");

  script_name(english:"Ubuntu 18.04 LTS / 19.04 / 19.10 : bind9 vulnerability (USN-4197-1)");
  script_summary(english:"Checks dpkg output for updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Ubuntu host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"It was discovered that Bind incorrectly handled certain TCP-pipelined
queries. A remote attacker could possibly use this issue to cause Bind
to consume resources, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://usn.ubuntu.com/4197-1/"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected bind9 package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6477");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:bind9");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:19.04");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:19.10");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/11/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/11/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/11/22");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"Ubuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Ubuntu Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("ubuntu.inc");
include("misc_func.inc");

if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/Ubuntu/release");
if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
release = chomp(release);
if (! preg(pattern:"^(18\.04|19\.04|19\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 18.04 / 19.04 / 19.10", "Ubuntu " + release);
if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);

flag = 0;

if (ubuntu_check(osver:"18.04", pkgname:"bind9", pkgver:"1:9.11.3+dfsg-1ubuntu1.11")) flag++;
if (ubuntu_check(osver:"19.04", pkgname:"bind9", pkgver:"1:9.11.5.P1+dfsg-1ubuntu2.6")) flag++;
if (ubuntu_check(osver:"19.10", pkgname:"bind9", pkgver:"1:9.11.5.P4+dfsg-5.1ubuntu2.1")) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : ubuntu_report_get()
  );
  exit(0);
}
else
{
  tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "bind9");
}
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1355.NASL
    descriptionAccording to the versions of the bind packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A programming error in the nxdomain-redirect feature can cause an assertion failure in query.c if the alternate namespace used by nxdomain-redirect is a descendant of a zone that is served locally. The most likely scenario where this might occur is if the server, in addition to performing NXDOMAIN redirection for recursive clients, is also serving a local copy of the root zone or using mirroring to provide the root zone, although other configurations are also possible. Versions affected: BIND 9.12.0-> 9.12.4, 9.14.0. Also affects all releases in the 9.13 development branch.(CVE-2019-6467) - With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server releasing these multiple resources can cause it to become unresponsive, even for queries that can be answered authoritatively or from cache. (This is most likely to be perceived as an intermittent server problem).(CVE-2019-6477) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-04-07
    modified2020-04-02
    plugin id135142
    published2020-04-02
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135142
    titleEulerOS Virtualization for ARM 64 3.0.6.0 : bind (EulerOS-SA-2020-1355)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(135142);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/06");

  script_cve_id(
    "CVE-2019-6467",
    "CVE-2019-6477"
  );

  script_name(english:"EulerOS Virtualization for ARM 64 3.0.6.0 : bind (EulerOS-SA-2020-1355)");
  script_summary(english:"Checks the rpm output for the updated packages.");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization for ARM 64 host is missing multiple security
updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the bind packages installed, the EulerOS
Virtualization for ARM 64 installation on the remote host is affected
by the following vulnerabilities :

  - A programming error in the nxdomain-redirect feature
    can cause an assertion failure in query.c if the
    alternate namespace used by nxdomain-redirect is a
    descendant of a zone that is served locally. The most
    likely scenario where this might occur is if the
    server, in addition to performing NXDOMAIN redirection
    for recursive clients, is also serving a local copy of
    the root zone or using mirroring to provide the root
    zone, although other configurations are also possible.
    Versions affected: BIND 9.12.0-> 9.12.4, 9.14.0. Also
    affects all releases in the 9.13 development
    branch.(CVE-2019-6467)

  - With pipelining enabled each incoming query on a TCP
    connection requires a similar resource allocation to a
    query received via UDP or via TCP without pipelining
    enabled. A client using a TCP-pipelined connection to a
    server could consume more resources than the server has
    been provisioned to handle. When a TCP connection with
    a large number of pipelined queries is closed, the load
    on the server releasing these multiple resources can
    cause it to become unresponsive, even for queries that
    can be answered authoritatively or from cache. (This is
    most likely to be perceived as an intermittent server
    problem).(CVE-2019-6477)

Note that Tenable Network Security has extracted the preceding
description block directly from the EulerOS security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1355
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2cc9ca9c");
  script_set_attribute(attribute:"solution", value:
"Update the affected bind packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"patch_publication_date", value:"2020/04/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/04/02");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:bind-export-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:bind-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:bind-libs-lite");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:bind-license");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:bind-utils");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python3-bind");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:3.0.6.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/EulerOS/release");
if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "3.0.6.0") audit(AUDIT_OS_NOT, "EulerOS Virtualization 3.0.6.0");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

flag = 0;

pkgs = ["bind-export-libs-9.11.4-10.P2.h19.eulerosv2r8",
        "bind-libs-9.11.4-10.P2.h19.eulerosv2r8",
        "bind-libs-lite-9.11.4-10.P2.h19.eulerosv2r8",
        "bind-license-9.11.4-10.P2.h19.eulerosv2r8",
        "bind-utils-9.11.4-10.P2.h19.eulerosv2r8",
        "python3-bind-9.11.4-10.P2.h19.eulerosv2r8"];

foreach (pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "bind");
}
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-1061.NASL
    descriptionThe remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1061 advisory. - bind: An assertion failure if a trust anchor rolls over to an unsupported key algorithm when using managed-keys (CVE-2018-5745) - bind: Controls for zone transfers may not be properly applied to DLZs if the zones are writable (CVE-2019-6465) - bind: TCP Pipelining doesn
    last seen2020-04-23
    modified2020-04-01
    plugin id135069
    published2020-04-01
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135069
    titleRHEL 7 : bind (RHSA-2020:1061)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-1845.NASL
    descriptionThe remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1845 advisory. - bind: TCP Pipelining doesn
    last seen2020-04-30
    modified2020-04-28
    plugin id136043
    published2020-04-28
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136043
    titleRHEL 8 : bind (RHSA-2020:1845)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-C703D2304A.NASL
    descriptionNew minor release with fix for latest CVE Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id132030
    published2019-12-13
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132030
    titleFedora 30 : 12:dhcp / 32:bind / bind-dyndb-ldap / dnsperf (2019-c703d2304a)
  • NASL familyF5 Networks Local Security Checks
    NASL idF5_BIGIP_SOL15840535.NASL
    descriptionWith pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server releasing these multiple resources can cause it to become unresponsive, even for queries that can be answered authoritatively or from cache. (This is most likely to be perceived as an intermittent server problem). (CVE-2019-6477) Impact An attacker may be able to use TCP-pipelined queries to increase the load on the system, causing it to become unresponsive.
    last seen2020-05-03
    modified2020-02-12
    plugin id133625
    published2020-02-12
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133625
    titleF5 Networks BIG-IP : BIND vulnerability (K15840535)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-73A8737068.NASL
    descriptionNew [minor release](https://downloads.isc.org/isc/bind9/9.11.13/RELEASE-NOTES-bin d-9.11.13.html) with fix for latest CVE. Includes TCP high-water in rndc status. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id131450
    published2019-12-03
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131450
    titleFedora 31 : 32:bind / bind-dyndb-ldap / dnsperf (2019-73a8737068)
  • NASL familySlackware Local Security Checks
    NASL idSLACKWARE_SSA_2019-324-01.NASL
    descriptionNew bind packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue.
    last seen2020-06-01
    modified2020-06-02
    plugin id131178
    published2019-11-21
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131178
    titleSlackware 14.0 / 14.1 / 14.2 / current : bind (SSA:2019-324-01)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2020-1061.NASL
    descriptionThe remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1061 advisory. - bind: An assertion failure if a trust anchor rolls over to an unsupported key algorithm when using managed-keys (CVE-2018-5745) - bind: Controls for zone transfers may not be properly applied to DLZs if the zones are writable (CVE-2019-6465) - bind: TCP Pipelining doesn
    last seen2020-06-06
    modified2020-04-10
    plugin id135328
    published2020-04-10
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135328
    titleCentOS 7 : bind (CESA-2020:1061)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1141.NASL
    descriptionAccording to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server releasing these multiple resources can cause it to become unresponsive, even for queries that can be answered authoritatively or from cache. (This is most likely to be perceived as an intermittent server problem).(CVE-2019-6477) - A programming error in the nxdomain-redirect feature can cause an assertion failure in query.c if the alternate namespace used by nxdomain-redirect is a descendant of a zone that is served locally. The most likely scenario where this might occur is if the server, in addition to performing NXDOMAIN redirection for recursive clients, is also serving a local copy of the root zone or using mirroring to provide the root zone, although other configurations are also possible. Versions affected: BIND 9.12.0-> 9.12.4, 9.14.0. Also affects all releases in the 9.13 development branch.(CVE-2019-6467) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-03
    modified2020-02-25
    plugin id133975
    published2020-02-25
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133975
    titleEulerOS 2.0 SP8 : bind (EulerOS-SA-2020-1141)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20200407_BIND_ON_SL7_X.NASL
    description* bind: TCP Pipelining doesn
    last seen2020-04-30
    modified2020-04-21
    plugin id135801
    published2020-04-21
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135801
    titleScientific Linux Security Update : bind on SL7.x x86_64 (20200407)
  • NASL familyDNS
    NASL idBIND9_9156.NASL
    descriptionA denial of service (DoS) vulnerability exists in ISC BIND 9 due to TCP Client issues. An unauthenticated, remote attacker can exploit this issue, via DNS Request, to cause the device to stop responding.
    last seen2020-05-23
    modified2019-12-06
    plugin id131735
    published2019-12-06
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131735
    titleISC BIND 9.11.0 / 9.11.x < 9.11.13 / 9.11.x < 9.11.13-S1 / 9.12.x < 9.12.5-P2 / 9.14.x < 9.14.8 / 9.15 / 9.15.x < 9.15.6 Vulnerability

Redhat

advisories
  • bugzilla
    id1773617
    titleCVE-2019-6477 bind: TCP Pipelining doesn't limit TCP clients on a single connection
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 7 is installed
        ovaloval:com.redhat.rhba:tst:20150364027
      • OR
        • AND
          • commentbind-license is earlier than 32:9.11.4-16.P2.el7
            ovaloval:com.redhat.rhsa:tst:20201061001
          • commentbind-license is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20171767022
        • AND
          • commentbind-utils is earlier than 32:9.11.4-16.P2.el7
            ovaloval:com.redhat.rhsa:tst:20201061003
          • commentbind-utils is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20170651012
        • AND
          • commentbind-pkcs11-utils is earlier than 32:9.11.4-16.P2.el7
            ovaloval:com.redhat.rhsa:tst:20201061005
          • commentbind-pkcs11-utils is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20171767014
        • AND
          • commentbind-pkcs11-libs is earlier than 32:9.11.4-16.P2.el7
            ovaloval:com.redhat.rhsa:tst:20201061007
          • commentbind-pkcs11-libs is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20171767006
        • AND
          • commentbind-pkcs11 is earlier than 32:9.11.4-16.P2.el7
            ovaloval:com.redhat.rhsa:tst:20201061009
          • commentbind-pkcs11 is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20171767020
        • AND
          • commentbind-libs-lite is earlier than 32:9.11.4-16.P2.el7
            ovaloval:com.redhat.rhsa:tst:20201061011
          • commentbind-libs-lite is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20171767024
        • AND
          • commentbind-libs is earlier than 32:9.11.4-16.P2.el7
            ovaloval:com.redhat.rhsa:tst:20201061013
          • commentbind-libs is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20170651010
        • AND
          • commentbind-export-libs is earlier than 32:9.11.4-16.P2.el7
            ovaloval:com.redhat.rhsa:tst:20201061015
          • commentbind-export-libs is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20191145002
        • AND
          • commentbind-chroot is earlier than 32:9.11.4-16.P2.el7
            ovaloval:com.redhat.rhsa:tst:20201061017
          • commentbind-chroot is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20170651008
        • AND
          • commentbind is earlier than 32:9.11.4-16.P2.el7
            ovaloval:com.redhat.rhsa:tst:20201061019
          • commentbind is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20170651006
        • AND
          • commentbind-sdb-chroot is earlier than 32:9.11.4-16.P2.el7
            ovaloval:com.redhat.rhsa:tst:20201061021
          • commentbind-sdb-chroot is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20171767018
        • AND
          • commentbind-sdb is earlier than 32:9.11.4-16.P2.el7
            ovaloval:com.redhat.rhsa:tst:20201061023
          • commentbind-sdb is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20170651002
        • AND
          • commentbind-pkcs11-devel is earlier than 32:9.11.4-16.P2.el7
            ovaloval:com.redhat.rhsa:tst:20201061025
          • commentbind-pkcs11-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20171767004
        • AND
          • commentbind-lite-devel is earlier than 32:9.11.4-16.P2.el7
            ovaloval:com.redhat.rhsa:tst:20201061027
          • commentbind-lite-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20171767016
        • AND
          • commentbind-export-devel is earlier than 32:9.11.4-16.P2.el7
            ovaloval:com.redhat.rhsa:tst:20201061029
          • commentbind-export-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20191145006
        • AND
          • commentbind-devel is earlier than 32:9.11.4-16.P2.el7
            ovaloval:com.redhat.rhsa:tst:20201061031
          • commentbind-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20170651004
    rhsa
    idRHSA-2020:1061
    released2020-03-31
    severityModerate
    titleRHSA-2020:1061: bind security and bug fix update (Moderate)
  • bugzilla
    id1790879
    titlenamed allocates new memory on each reload
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 8 is installed
        ovaloval:com.redhat.rhba:tst:20193384074
      • OR
        • AND
          • commentbind-debugsource is earlier than 32:9.11.13-3.el8
            ovaloval:com.redhat.rhsa:tst:20201845001
          • commentbind-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20191145004
        • AND
          • commentbind-export-libs is earlier than 32:9.11.13-3.el8
            ovaloval:com.redhat.rhsa:tst:20201845003
          • commentbind-export-libs is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20191145002
        • AND
          • commentbind-export-devel is earlier than 32:9.11.13-3.el8
            ovaloval:com.redhat.rhsa:tst:20201845005
          • commentbind-export-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20191145006
        • AND
          • commentpython3-bind is earlier than 32:9.11.13-3.el8
            ovaloval:com.redhat.rhsa:tst:20201845007
          • commentpython3-bind is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20191145008
        • AND
          • commentbind-license is earlier than 32:9.11.13-3.el8
            ovaloval:com.redhat.rhsa:tst:20201845009
          • commentbind-license is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20171767022
        • AND
          • commentbind-utils is earlier than 32:9.11.13-3.el8
            ovaloval:com.redhat.rhsa:tst:20201845011
          • commentbind-utils is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20170651012
        • AND
          • commentbind-sdb-chroot is earlier than 32:9.11.13-3.el8
            ovaloval:com.redhat.rhsa:tst:20201845013
          • commentbind-sdb-chroot is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20171767018
        • AND
          • commentbind-sdb is earlier than 32:9.11.13-3.el8
            ovaloval:com.redhat.rhsa:tst:20201845015
          • commentbind-sdb is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20170651002
        • AND
          • commentbind-pkcs11-utils is earlier than 32:9.11.13-3.el8
            ovaloval:com.redhat.rhsa:tst:20201845017
          • commentbind-pkcs11-utils is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20171767014
        • AND
          • commentbind-pkcs11-libs is earlier than 32:9.11.13-3.el8
            ovaloval:com.redhat.rhsa:tst:20201845019
          • commentbind-pkcs11-libs is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20171767006
        • AND
          • commentbind-pkcs11-devel is earlier than 32:9.11.13-3.el8
            ovaloval:com.redhat.rhsa:tst:20201845021
          • commentbind-pkcs11-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20171767004
        • AND
          • commentbind-pkcs11 is earlier than 32:9.11.13-3.el8
            ovaloval:com.redhat.rhsa:tst:20201845023
          • commentbind-pkcs11 is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20171767020
        • AND
          • commentbind-lite-devel is earlier than 32:9.11.13-3.el8
            ovaloval:com.redhat.rhsa:tst:20201845025
          • commentbind-lite-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20171767016
        • AND
          • commentbind-libs-lite is earlier than 32:9.11.13-3.el8
            ovaloval:com.redhat.rhsa:tst:20201845027
          • commentbind-libs-lite is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20171767024
        • AND
          • commentbind-libs is earlier than 32:9.11.13-3.el8
            ovaloval:com.redhat.rhsa:tst:20201845029
          • commentbind-libs is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20170651010
        • AND
          • commentbind-devel is earlier than 32:9.11.13-3.el8
            ovaloval:com.redhat.rhsa:tst:20201845031
          • commentbind-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20170651004
        • AND
          • commentbind-chroot is earlier than 32:9.11.13-3.el8
            ovaloval:com.redhat.rhsa:tst:20201845033
          • commentbind-chroot is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20170651008
        • AND
          • commentbind is earlier than 32:9.11.13-3.el8
            ovaloval:com.redhat.rhsa:tst:20201845035
          • commentbind is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhba:tst:20170651006
    rhsa
    idRHSA-2020:1845
    released2020-04-28
    severityModerate
    titleRHSA-2020:1845: bind security, bug fix, and enhancement update (Moderate)
rpms
  • bind-32:9.11.4-16.P2.el7
  • bind-chroot-32:9.11.4-16.P2.el7
  • bind-debuginfo-32:9.11.4-16.P2.el7
  • bind-devel-32:9.11.4-16.P2.el7
  • bind-export-devel-32:9.11.4-16.P2.el7
  • bind-export-libs-32:9.11.4-16.P2.el7
  • bind-libs-32:9.11.4-16.P2.el7
  • bind-libs-lite-32:9.11.4-16.P2.el7
  • bind-license-32:9.11.4-16.P2.el7
  • bind-lite-devel-32:9.11.4-16.P2.el7
  • bind-pkcs11-32:9.11.4-16.P2.el7
  • bind-pkcs11-devel-32:9.11.4-16.P2.el7
  • bind-pkcs11-libs-32:9.11.4-16.P2.el7
  • bind-pkcs11-utils-32:9.11.4-16.P2.el7
  • bind-sdb-32:9.11.4-16.P2.el7
  • bind-sdb-chroot-32:9.11.4-16.P2.el7
  • bind-utils-32:9.11.4-16.P2.el7
  • bind-32:9.11.13-3.el8
  • bind-chroot-32:9.11.13-3.el8
  • bind-debuginfo-32:9.11.13-3.el8
  • bind-debugsource-32:9.11.13-3.el8
  • bind-devel-32:9.11.13-3.el8
  • bind-export-devel-32:9.11.13-3.el8
  • bind-export-libs-32:9.11.13-3.el8
  • bind-export-libs-debuginfo-32:9.11.13-3.el8
  • bind-libs-32:9.11.13-3.el8
  • bind-libs-debuginfo-32:9.11.13-3.el8
  • bind-libs-lite-32:9.11.13-3.el8
  • bind-libs-lite-debuginfo-32:9.11.13-3.el8
  • bind-license-32:9.11.13-3.el8
  • bind-lite-devel-32:9.11.13-3.el8
  • bind-pkcs11-32:9.11.13-3.el8
  • bind-pkcs11-debuginfo-32:9.11.13-3.el8
  • bind-pkcs11-devel-32:9.11.13-3.el8
  • bind-pkcs11-libs-32:9.11.13-3.el8
  • bind-pkcs11-libs-debuginfo-32:9.11.13-3.el8
  • bind-pkcs11-utils-32:9.11.13-3.el8
  • bind-pkcs11-utils-debuginfo-32:9.11.13-3.el8
  • bind-sdb-32:9.11.13-3.el8
  • bind-sdb-chroot-32:9.11.13-3.el8
  • bind-sdb-debuginfo-32:9.11.13-3.el8
  • bind-utils-32:9.11.13-3.el8
  • bind-utils-debuginfo-32:9.11.13-3.el8
  • python3-bind-32:9.11.13-3.el8

References