CVE-2020-8623

A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c

State: Published
Severity: 7.5 High
Published: Aug 21, 2020
Updated: Sep 17, 2024
Reserved: Feb 5, 2020

Description

In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with "--enable-native-pkcs11" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	isc

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
BIND9ISC	9.10.0 to before unspecifiedAffected before 9.11.22Affected 9.12.0 to before unspecifiedAffected before 9.16.6Affected 9.17.0 to before unspecifiedAffected before 9.17.4Affected 9.10.5-S1 to before Supported Preview*Affectedfrom 9.11.22-S1Not affected

References

https://kb.isc.org/docs/cve-2020-8623
FEDORA-2020-a02b7a0f21vendor-advisory
https://security.netapp.com/advisory/ntap-20200827-0003/
USN-4468-1vendor-advisory
DSA-4752vendor-advisory
FEDORA-2020-14c194e5afvendor-advisory
[debian-lts-announce] 20200829 [SECURITY] [DLA 2355-1] bind9 security updatemailing-list
GLSA-202008-19vendor-advisory
https://www.synology.com/security/advisory/Synology_SA_20_19
openSUSE-SU-2020:1699vendor-advisory
openSUSE-SU-2020:1701vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.