CVE-2020-8622
In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.
- Isc Bind
- ≤ 9.11.21, 9.16.5, 9.17.3
- Fix
- Available
- CVSS 3.1
- 6.5 MEDIUM
- EPSS
- 5.6% (92th percentile)
- Weakness
- CWE-617
- NVD status
- Modified
- Published
- 2020-08-21
Fix
Upgrade to the patched release most closely related to your current version of BIND: BIND 9.11.22 BIND 9.16.6 BIND 9.17.4 BIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers. BIND 9.11.22-S1
Workaround
No workarounds known.
No indexed exploits for CVE-2020-8622 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2020-8622 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.