Bug 2128584 (CVE-2022-2795)
| Summary: | CVE-2022-2795 bind: processing large delegations may severely degrade resolver performance | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marian Rehak <mrehak> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aegorenkov.91, anon.amish, dns-sig, jorton, kyoneyam, mosvald, mruprich, pavel, pemensik, security-response-team, vonsch, zdohnal |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | bind 9.16.33, bind 9.18.7, bind 9.19.5 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in bind. When flooding the target resolver with special queries, an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-01-26 14:52:14 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2128705, 2128707, 2128743, 2128744, 2128745, 2128746, 2128747 | ||
| Bug Blocks: | 2128582 | ||
|
Description
Marian Rehak
2022-09-21 07:36:02 UTC
Created bind tracking bugs for this issue: Affects: fedora-all [bug 2128705] Created dhcp tracking bugs for this issue: Affects: fedora-all [bug 2128707] This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2023:0402 https://access.redhat.com/errata/RHSA-2023:0402 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-2795 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:2261 https://access.redhat.com/errata/RHSA-2023:2261 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:2792 https://access.redhat.com/errata/RHSA-2023:2792 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:3002 https://access.redhat.com/errata/RHSA-2023:3002 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2024:2720 https://access.redhat.com/errata/RHSA-2024:2720 |