CVE-2021-25220

DNS forwarders - cache poisoning vulnerability

State: Published
Severity: 6.8 Medium
Published: Mar 23, 2022
Updated: Sep 16, 2024
Reserved: Jan 15, 2021

Description

BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N	isc

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
BINDISC	Open Source Branch 9.11 9.11.0 through versions before 9.11.37Affected Development Branch 9.17 BIND 9.17 all versionAffected Open Source Branch 9.12-16 9.12.0 through versions before 9.16.27Affected Open Source Branch 9.18 9.18.0Affected Supported Preview Branch 9.11-S 9.11.0-S through versions before 9.11.37-SAffected Supported Preview Branch 9.16-S 9.16.0-S through versions before 9.16.27-SAffected

Product

Versions

BINDISC

Open Source Branch 9.11 9.11.0 through versions before 9.11.37Affected
Development Branch 9.17 BIND 9.17 all versionAffected
Open Source Branch 9.12-16 9.12.0 through versions before 9.16.27Affected
Open Source Branch 9.18 9.18.0Affected
Supported Preview Branch 9.11-S 9.11.0-S through versions before 9.11.37-SAffected
Supported Preview Branch 9.16-S 9.16.0-S through versions before 9.16.27-SAffected

References

https://kb.isc.org/v1/docs/cve-2021-25220
FEDORA-2022-14e36aac0cvendor-advisory
FEDORA-2022-042d9c6146vendor-advisory
https://security.netapp.com/advisory/ntap-20220408-0001/
FEDORA-2022-a88218de5cvendor-advisory
FEDORA-2022-05918f0838vendor-advisory
FEDORA-2022-3f293290c3vendor-advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
GLSA-202210-25vendor-advisory
https://supportportal.juniper.net/s/article/2022-10-Security-Bulletin-Junos-OS-SRX-Series-Cache-poisoning-vulnerability-in-BIND-used-by-DNS-Proxy-CVE-2021-25220?language=en_US

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.