[gentoo-announce] [ GLSA 202210-25 ] ISC BIND: Multiple Vulnerabilities - gentoo-announce

From:	glsamaker@g.o
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 202210-25 ] ISC BIND: Multiple Vulnerabilities
Date:	Mon, 31 Oct 2022 02:02:47
Message-Id:	`166717908635.9.17856687163402036562@90bb6a0775af`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 202210-25

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Low

8

    Title: ISC BIND: Multiple Vulnerabilities

9

     Date: October 31, 2022

10

     Bugs: #820563, #835439, #872206

11

       ID: 202210-25

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been discovered in ISC BIND, the worst of

19

which could result in denial of service.

20

21

Background

22

==========

23

24

ISC BIND is the Internet Systems Consortium implementation of the Domain

25

Name System (DNS) protocol.

26

27

Affected packages

28

=================

29

30

    -------------------------------------------------------------------

31

     Package              /     Vulnerable     /            Unaffected

32

    -------------------------------------------------------------------

33

  1  net-dns/bind               < 9.16.33                  >= 9.16.33

34

  2  net-dns/bind-tools         < 9.16.33                  >= 9.16.33

35

36

Description

37

===========

38

39

Multiple vulnerabilities have been discovered in ISC BIND. Please review

40

the CVE identifiers referenced below for details.

41

42

Impact

43

======

44

45

Please review the referenced CVE identifiers for details.

46

47

Workaround

48

==========

49

50

There is no known workaround at this time.

51

52

Resolution

53

==========

54

55

All ISC BIND users should upgrade to the latest version:

56

57

  # emerge --sync

58

  # emerge --ask --oneshot --verbose ">=net-dns/bind-9.16.33"

59

60

All ISC BIND-tools users should upgrade to the latest version:

61

62

  # emerge --sync

63

  # emerge --ask --oneshot --verbose ">=net-dns/bind-tools-9.16.33"

64

65

References

66

==========

67

68

[ 1 ] CVE-2021-25219

69

      https://nvd.nist.gov/vuln/detail/CVE-2021-25219

70

[ 2 ] CVE-2021-25220

71

      https://nvd.nist.gov/vuln/detail/CVE-2021-25220

72

[ 3 ] CVE-2022-0396

73

      https://nvd.nist.gov/vuln/detail/CVE-2022-0396

74

[ 4 ] CVE-2022-2795

75

      https://nvd.nist.gov/vuln/detail/CVE-2022-2795

76

[ 5 ] CVE-2022-2881

77

      https://nvd.nist.gov/vuln/detail/CVE-2022-2881

78

[ 6 ] CVE-2022-2906

79

      https://nvd.nist.gov/vuln/detail/CVE-2022-2906

80

[ 7 ] CVE-2022-3080

81

      https://nvd.nist.gov/vuln/detail/CVE-2022-3080

82

[ 8 ] CVE-2022-38177

83

      https://nvd.nist.gov/vuln/detail/CVE-2022-38177

84

[ 9 ] CVE-2022-38178

85

      https://nvd.nist.gov/vuln/detail/CVE-2022-38178

86

87

Availability

88

============

89

90

This GLSA and any updates to it are available for viewing at

91

the Gentoo Security Website:

92

93

 https://security.gentoo.org/glsa/202210-25

94

95

Concerns?

96

=========

97

98

Security is a primary focus of Gentoo Linux and ensuring the

99

confidentiality and security of our users' machines is of utmost

100

importance to us. Any security concerns should be addressed to

101

security@g.o or alternatively, you may file a bug at

102

https://bugs.gentoo.org.

103

104

License

105

=======

106

107

Copyright 2022 Gentoo Foundation, Inc; referenced text

108

belongs to its owner(s).

109

110

The contents of this document are licensed under the

111

Creative Commons - Attribution / Share Alike license.

112

113

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 202210-25
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Low
8	Title: ISC BIND: Multiple Vulnerabilities
9	Date: October 31, 2022
10	Bugs: #820563, #835439, #872206
11	ID: 202210-25
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been discovered in ISC BIND, the worst of
19	which could result in denial of service.
20
21	Background
22	==========
23
24	ISC BIND is the Internet Systems Consortium implementation of the Domain
25	Name System (DNS) protocol.
26
27	Affected packages
28	=================
29
30	-------------------------------------------------------------------
31	Package / Vulnerable / Unaffected
32	-------------------------------------------------------------------
33	1 net-dns/bind < 9.16.33 >= 9.16.33
34	2 net-dns/bind-tools < 9.16.33 >= 9.16.33
35
36	Description
37	===========
38
39	Multiple vulnerabilities have been discovered in ISC BIND. Please review
40	the CVE identifiers referenced below for details.
41
42	Impact
43	======
44
45	Please review the referenced CVE identifiers for details.
46
47	Workaround
48	==========
49
50	There is no known workaround at this time.
51
52	Resolution
53	==========
54
55	All ISC BIND users should upgrade to the latest version:
56
57	# emerge --sync
58	# emerge --ask --oneshot --verbose ">=net-dns/bind-9.16.33"
59
60	All ISC BIND-tools users should upgrade to the latest version:
61
62	# emerge --sync
63	# emerge --ask --oneshot --verbose ">=net-dns/bind-tools-9.16.33"
64
65	References
66	==========
67
68	[ 1 ] CVE-2021-25219
69	https://nvd.nist.gov/vuln/detail/CVE-2021-25219
70	[ 2 ] CVE-2021-25220
71	https://nvd.nist.gov/vuln/detail/CVE-2021-25220
72	[ 3 ] CVE-2022-0396
73	https://nvd.nist.gov/vuln/detail/CVE-2022-0396
74	[ 4 ] CVE-2022-2795
75	https://nvd.nist.gov/vuln/detail/CVE-2022-2795
76	[ 5 ] CVE-2022-2881
77	https://nvd.nist.gov/vuln/detail/CVE-2022-2881
78	[ 6 ] CVE-2022-2906
79	https://nvd.nist.gov/vuln/detail/CVE-2022-2906
80	[ 7 ] CVE-2022-3080
81	https://nvd.nist.gov/vuln/detail/CVE-2022-3080
82	[ 8 ] CVE-2022-38177
83	https://nvd.nist.gov/vuln/detail/CVE-2022-38177
84	[ 9 ] CVE-2022-38178
85	https://nvd.nist.gov/vuln/detail/CVE-2022-38178
86
87	Availability
88	============
89
90	This GLSA and any updates to it are available for viewing at
91	the Gentoo Security Website:
92
93	https://security.gentoo.org/glsa/202210-25
94
95	Concerns?
96	=========
97
98	Security is a primary focus of Gentoo Linux and ensuring the
99	confidentiality and security of our users' machines is of utmost
100	importance to us. Any security concerns should be addressed to
101	security@g.o or alternatively, you may file a bug at
102	https://bugs.gentoo.org.
103
104	License
105	=======
106
107	Copyright 2022 Gentoo Foundation, Inc; referenced text
108	belongs to its owner(s).
109
110	The contents of this document are licensed under the
111	Creative Commons - Attribution / Share Alike license.
112
113	https://creativecommons.org/licenses/by-sa/2.5