- ------------------------------------------------------------------------- Debian Security Advisory DSA-5235-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 22, 2022 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : bind9 CVE ID : CVE-2022-2795 CVE-2022-3080 CVE-2022-38177 CVE-2022-38178 Several vulnerabilities were discovered in BIND, a DNS server implementation. CVE-2022-2795 Yehuda Afek, Anat Bremler-Barr and Shani Stajnrod discovered that a flaw in the resolver code can cause named to spend excessive amounts of time on processing large delegations, significantly degrade resolver performance and result in denial of service. CVE-2022-3080 Maksym Odinintsev discovered that the resolver can crash when stale cache and stale answers are enabled with a zero stale-answer-timeout. A remote attacker can take advantage of this flaw to cause a denial of service (daemon crash) via specially crafted queries to the resolver. CVE-2022-38177 It was discovered that the DNSSEC verification code for the ECDSA algorithm is susceptible to a memory leak flaw. A remote attacker can take advantage of this flaw to cause BIND to consume resources, resulting in a denial of service. CVE-2022-38178 It was discovered that the DNSSEC verification code for the EdDSA algorithm is susceptible to a memory leak flaw. A remote attacker can take advantage of this flaw to cause BIND to consume resources, resulting in a denial of service. For the stable distribution (bullseye), these problems have been fixed in version 1:9.16.33-1~deb11u1. We recommend that you upgrade your bind9 packages. For the detailed security status of bind9 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/bind9 Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: [email protected]