CVE-2022-3080

BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly

State: Published
Severity: 7.5 High
Published: Sep 21, 2022
Updated: Sep 17, 2024
Reserved: Sep 1, 2022

Description

By sending specific queries to the resolver, an attacker can cause named to crash.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	isc

Weaknesses

CWE-613 Insufficient Session Expiration

Affected Products

Product	Versions
BIND9ISC	Open Source Branch 9.16 9.16.14 through versions before 9.16.33Affected Open Source Branch 9.18 9.18.0 through versions before 9.18.7Affected Supported Preview Branch 9.16-S 9.16.14-S1 through versions before 9.16.33-S1Affected Development Branch 9.19 9.19.0 through versions before 9.19.5Affected

References

https://kb.isc.org/docs/cve-2022-3080
[oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178)mailing-list
DSA-5235vendor-advisory
FEDORA-2022-ef038365devendor-advisory
FEDORA-2022-8268735e06vendor-advisory
FEDORA-2022-b197d64471vendor-advisory
GLSA-202210-25vendor-advisory
https://security.netapp.com/advisory/ntap-20240621-0002/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.