Bug 2298904 (CVE-2024-4076)

Summary:	CVE-2024-4076 bind: bind9: Assertion failure when serving both stale cache data and authoritative zone content
Product:	[Other] Security Response	Reporter:	Marco Benatto <mbenatto>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	asdas, bmontgom, dpaolell, eparis, jburrell, jdelft, jupierce, lgarciaa, mbiarnes, nstielau, security-response-team, sidsharm, sponnaga, talessio, vlaad, ximhan, yuxzhu
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the bind9 package, where a client query triggers stale data and also requires local lookups may trigger a assertion failure. This issue results in a denial of service of the bind server.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2300837, 2300838
Bug Blocks:
Deadline:	2024-07-23

Description Marco Benatto 2024-07-19 19:56:08 UTC

Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure.
This vulnerability affects upstream's bind9 versions bellow:
9.16.13 -> 9.16.50
9.18.0 -> 9.18.27
9.19.0 -> 9.19.24

Comment 3 errata-xmlrpc 2024-08-12 13:40:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:5231 https://access.redhat.com/errata/RHSA-2024:5231

Comment 4 errata-xmlrpc 2024-08-14 11:43:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:5390 https://access.redhat.com/errata/RHSA-2024:5390

Comment 5 errata-xmlrpc 2024-08-15 01:52:56 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2024:5418 https://access.redhat.com/errata/RHSA-2024:5418

Comment 6 errata-xmlrpc 2024-08-19 05:59:45 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:5525 https://access.redhat.com/errata/RHSA-2024:5525

Comment 7 errata-xmlrpc 2024-08-26 08:05:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:5813 https://access.redhat.com/errata/RHSA-2024:5813

Comment 8 errata-xmlrpc 2024-08-27 18:20:49 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2024:5907 https://access.redhat.com/errata/RHSA-2024:5907

Comment 9 errata-xmlrpc 2024-09-03 19:14:42 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.16

Via RHSA-2024:6004 https://access.redhat.com/errata/RHSA-2024:6004

Comment 10 errata-xmlrpc 2024-09-04 07:57:19 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2024:6009 https://access.redhat.com/errata/RHSA-2024:6009

Comment 11 errata-xmlrpc 2024-09-05 05:56:42 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.15

Via RHSA-2024:6013 https://access.redhat.com/errata/RHSA-2024:6013

Comment 12 errata-xmlrpc 2024-09-11 18:34:55 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2024:6406 https://access.redhat.com/errata/RHSA-2024:6406