-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: bind security and bug fix update Advisory ID: RHSA-2023:2261-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:2261 Issue date: 2023-05-09 CVE Names: CVE-2022-2795 CVE-2022-3094 CVE-2022-3736 CVE-2022-3924 ==================================================================== 1. Summary: An update for bind is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 9) - aarch64, noarch, ppc64le, s390x, x86_64 Red Hat Enterprise Linux CRB (v. 9) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: processing large delegations may severely degrade resolver performance (CVE-2022-2795) * bind: flooding with UPDATE requests may lead to DoS (CVE-2022-3094) * bind: sending specific queries to the resolver may cause a DoS (CVE-2022-3736) * bind: sending specific queries to the resolver may cause a DoS (CVE-2022-3924) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, the BIND daemon (named) will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 2126912 - named-pkcs11 crashing into dns-pkcs11 library red-black tree [bind rhel-9.2.0] 2128584 - CVE-2022-2795 bind: processing large delegations may severely degrade resolver performance 2129466 - bind-chroot-9.16.23-1.el9.x86_64 fails to create mount point /var/named/chroot/usr/lib64/named in chroot 2162795 - bind-dyndb-ldap fail to build with current bind 9.16.23 [rhel9] 2164032 - CVE-2022-3094 bind: flooding with UPDATE requests may lead to DoS 2164038 - CVE-2022-3736 bind: sending specific queries to the resolver may cause a DoS 2164039 - CVE-2022-3924 bind: sending specific queries to the resolver may cause a DoS 6. Package List: Red Hat Enterprise Linux AppStream (v. 9): Source: bind-9.16.23-11.el9.src.rpm aarch64: bind-9.16.23-11.el9.aarch64.rpm bind-chroot-9.16.23-11.el9.aarch64.rpm bind-debuginfo-9.16.23-11.el9.aarch64.rpm bind-debugsource-9.16.23-11.el9.aarch64.rpm bind-dnssec-utils-9.16.23-11.el9.aarch64.rpm bind-dnssec-utils-debuginfo-9.16.23-11.el9.aarch64.rpm bind-libs-9.16.23-11.el9.aarch64.rpm bind-libs-debuginfo-9.16.23-11.el9.aarch64.rpm bind-utils-9.16.23-11.el9.aarch64.rpm bind-utils-debuginfo-9.16.23-11.el9.aarch64.rpm noarch: bind-dnssec-doc-9.16.23-11.el9.noarch.rpm bind-license-9.16.23-11.el9.noarch.rpm python3-bind-9.16.23-11.el9.noarch.rpm ppc64le: bind-9.16.23-11.el9.ppc64le.rpm bind-chroot-9.16.23-11.el9.ppc64le.rpm bind-debuginfo-9.16.23-11.el9.ppc64le.rpm bind-debugsource-9.16.23-11.el9.ppc64le.rpm bind-dnssec-utils-9.16.23-11.el9.ppc64le.rpm bind-dnssec-utils-debuginfo-9.16.23-11.el9.ppc64le.rpm bind-libs-9.16.23-11.el9.ppc64le.rpm bind-libs-debuginfo-9.16.23-11.el9.ppc64le.rpm bind-utils-9.16.23-11.el9.ppc64le.rpm bind-utils-debuginfo-9.16.23-11.el9.ppc64le.rpm s390x: bind-9.16.23-11.el9.s390x.rpm bind-chroot-9.16.23-11.el9.s390x.rpm bind-debuginfo-9.16.23-11.el9.s390x.rpm bind-debugsource-9.16.23-11.el9.s390x.rpm bind-dnssec-utils-9.16.23-11.el9.s390x.rpm bind-dnssec-utils-debuginfo-9.16.23-11.el9.s390x.rpm bind-libs-9.16.23-11.el9.s390x.rpm bind-libs-debuginfo-9.16.23-11.el9.s390x.rpm bind-utils-9.16.23-11.el9.s390x.rpm bind-utils-debuginfo-9.16.23-11.el9.s390x.rpm x86_64: bind-9.16.23-11.el9.x86_64.rpm bind-chroot-9.16.23-11.el9.x86_64.rpm bind-debuginfo-9.16.23-11.el9.x86_64.rpm bind-debugsource-9.16.23-11.el9.x86_64.rpm bind-dnssec-utils-9.16.23-11.el9.x86_64.rpm bind-dnssec-utils-debuginfo-9.16.23-11.el9.x86_64.rpm bind-libs-9.16.23-11.el9.x86_64.rpm bind-libs-debuginfo-9.16.23-11.el9.x86_64.rpm bind-utils-9.16.23-11.el9.x86_64.rpm bind-utils-debuginfo-9.16.23-11.el9.x86_64.rpm Red Hat Enterprise Linux CRB (v. 9): aarch64: bind-debuginfo-9.16.23-11.el9.aarch64.rpm bind-debugsource-9.16.23-11.el9.aarch64.rpm bind-devel-9.16.23-11.el9.aarch64.rpm bind-dnssec-utils-debuginfo-9.16.23-11.el9.aarch64.rpm bind-libs-debuginfo-9.16.23-11.el9.aarch64.rpm bind-utils-debuginfo-9.16.23-11.el9.aarch64.rpm noarch: bind-doc-9.16.23-11.el9.noarch.rpm ppc64le: bind-debuginfo-9.16.23-11.el9.ppc64le.rpm bind-debugsource-9.16.23-11.el9.ppc64le.rpm bind-devel-9.16.23-11.el9.ppc64le.rpm bind-dnssec-utils-debuginfo-9.16.23-11.el9.ppc64le.rpm bind-libs-debuginfo-9.16.23-11.el9.ppc64le.rpm bind-utils-debuginfo-9.16.23-11.el9.ppc64le.rpm s390x: bind-debuginfo-9.16.23-11.el9.s390x.rpm bind-debugsource-9.16.23-11.el9.s390x.rpm bind-devel-9.16.23-11.el9.s390x.rpm bind-dnssec-utils-debuginfo-9.16.23-11.el9.s390x.rpm bind-libs-debuginfo-9.16.23-11.el9.s390x.rpm bind-utils-debuginfo-9.16.23-11.el9.s390x.rpm x86_64: bind-debuginfo-9.16.23-11.el9.i686.rpm bind-debuginfo-9.16.23-11.el9.x86_64.rpm bind-debugsource-9.16.23-11.el9.i686.rpm bind-debugsource-9.16.23-11.el9.x86_64.rpm bind-devel-9.16.23-11.el9.i686.rpm bind-devel-9.16.23-11.el9.x86_64.rpm bind-dnssec-utils-debuginfo-9.16.23-11.el9.i686.rpm bind-dnssec-utils-debuginfo-9.16.23-11.el9.x86_64.rpm bind-libs-9.16.23-11.el9.i686.rpm bind-libs-debuginfo-9.16.23-11.el9.i686.rpm bind-libs-debuginfo-9.16.23-11.el9.x86_64.rpm bind-utils-debuginfo-9.16.23-11.el9.i686.rpm bind-utils-debuginfo-9.16.23-11.el9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-2795 https://access.redhat.com/security/cve/CVE-2022-3094 https://access.redhat.com/security/cve/CVE-2022-3736 https://access.redhat.com/security/cve/CVE-2022-3924 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZFo0xdzjgjWX9erEAQggwg//YUiL9t9HAN2lst0nJtfRxOM/HnD0k15Q kubnLDX6ZXqGBdPkEHNPhAf+fgMnS1/UuxEbYkbXCf7ObyGeBG+Q08QCDGi/hNWs k/S+FfNQ2Ca4aq5OdPsgz3QXGv4HbUFDMoFPz1Kc5NI2XjjaBPARjlZBLTSUV+WK ftjhFDoudKI/MxVqrnptZRXgnlGDekq54b2X9xyJ/eqzA0OBvdxDTOsv7/U3fUTu GURcI62D5QIQxzGEUcvkUl/yBXbQuQDHX7JH4z2hH0TB2EIwwsoFtk4pLofmpcc0 F6G7ZLG+saMKd758gsqqHBHAjbot70Bx5taEFtMDHlxjIPVrqPxesvulsyXfb5qs /Dt/A49jXEkXxZPUtxZouQ5bAVJPyf3f+ZPAZAWG/BENWzia6wvGgSErijJ6b6D1 thEb/y8xYWKLnfcF/OkfDcCYc5spVyrqeyzAhV7Rjf38Pcgg5zhJ4ZSVr8r1FVvE Deu/b+kTrUdOQm8bmCzZrqglsT4fulEXayY23fCCHlb8f4UzI5FZyiXiPsIGkJJB Lo34//+6rXOvlp+WLz3PdAlc9+I4QQ5lEzgabxBFNmoXSj4xW663p9x0O75nePZc 7gR1qZX17xx7jLXHQ/VtyXtXiwWZjz9hqOJ5i1NKFxbk9eBFMQnz6Nd+pIKDZWhc tzmXhv5wEuM=6rgi -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce