Bug 2298893 (CVE-2024-1737) - CVE-2024-1737 bind: bind9: BIND's database will be slow if a very large number of RRs exist at the same nam
Summary: CVE-2024-1737 bind: bind9: BIND's database will be slow if a very large numbe...
Keywords:
Status: NEW
Alias: CVE-2024-1737
Deadline: 2024-07-23
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-07-19 17:17 UTC by Marco Benatto
Modified: 2024-09-19 08:42 UTC (History)
20 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the bind9 package, where a hostname with significant resource records may slow down bind's resolver cache and authoritative zone databases while these records are being added or updated. In addition, client queries for the related hostname may cause the same issue. This vulnerability may lead to a denial of service.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:5704 0 None None None 2024-08-21 12:22:43 UTC
Red Hat Product Errata RHBA-2024:5855 0 None None None 2024-08-26 11:05:35 UTC
Red Hat Product Errata RHBA-2024:5887 0 None None None 2024-08-27 09:11:48 UTC
Red Hat Product Errata RHBA-2024:5909 0 None None None 2024-08-27 20:25:30 UTC
Red Hat Product Errata RHBA-2024:5931 0 None None None 2024-08-28 11:49:46 UTC
Red Hat Product Errata RHSA-2024:5231 0 None None None 2024-08-12 13:40:52 UTC
Red Hat Product Errata RHSA-2024:5390 0 None None None 2024-08-14 11:43:06 UTC
Red Hat Product Errata RHSA-2024:5418 0 None None None 2024-08-15 01:52:58 UTC
Red Hat Product Errata RHSA-2024:5524 0 None None None 2024-08-19 06:50:06 UTC
Red Hat Product Errata RHSA-2024:5525 0 None None None 2024-08-19 05:59:45 UTC
Red Hat Product Errata RHSA-2024:5655 0 None None None 2024-08-20 18:13:43 UTC
Red Hat Product Errata RHSA-2024:5813 0 None None None 2024-08-26 08:05:31 UTC
Red Hat Product Errata RHSA-2024:5838 0 None None None 2024-08-26 08:11:59 UTC
Red Hat Product Errata RHSA-2024:5871 0 None None None 2024-08-26 18:11:15 UTC
Red Hat Product Errata RHSA-2024:5894 0 None None None 2024-08-27 11:24:58 UTC
Red Hat Product Errata RHSA-2024:5907 0 None None None 2024-08-27 18:20:51 UTC
Red Hat Product Errata RHSA-2024:5908 0 None None None 2024-08-27 18:40:49 UTC
Red Hat Product Errata RHSA-2024:5930 0 None None None 2024-08-28 11:31:17 UTC
Red Hat Product Errata RHSA-2024:6004 0 None None None 2024-09-03 19:14:04 UTC
Red Hat Product Errata RHSA-2024:6009 0 None None None 2024-09-04 07:57:10 UTC
Red Hat Product Errata RHSA-2024:6013 0 None None None 2024-09-05 05:56:45 UTC
Red Hat Product Errata RHSA-2024:6406 0 None None None 2024-09-11 18:34:52 UTC
Red Hat Product Errata RHSA-2024:6642 0 None None None 2024-09-18 03:07:26 UTC

Description Marco Benatto 2024-07-19 17:17:54 UTC 
Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name.
This vulnerability affects the following bind versions:
9.11.0 -> 9.11.37
9.16.0 -> 9.16.50
9.18.0 -> 9.18.27
9.19.0 -> 9.19.24
Comment 3 errata-xmlrpc 2024-08-12 13:40:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:5231 https://access.redhat.com/errata/RHSA-2024:5231
Comment 4 errata-xmlrpc 2024-08-14 11:43:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:5390 https://access.redhat.com/errata/RHSA-2024:5390
Comment 5 errata-xmlrpc 2024-08-15 01:52:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2024:5418 https://access.redhat.com/errata/RHSA-2024:5418
Comment 8 errata-xmlrpc 2024-08-19 05:59:43 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:5525 https://access.redhat.com/errata/RHSA-2024:5525
Comment 9 errata-xmlrpc 2024-08-19 06:50:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:5524 https://access.redhat.com/errata/RHSA-2024:5524
Comment 10 errata-xmlrpc 2024-08-20 18:13:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2024:5655 https://access.redhat.com/errata/RHSA-2024:5655
Comment 11 errata-xmlrpc 2024-08-26 08:05:29 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:5813 https://access.redhat.com/errata/RHSA-2024:5813
Comment 12 errata-xmlrpc 2024-08-26 08:11:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:5838 https://access.redhat.com/errata/RHSA-2024:5838
Comment 13 errata-xmlrpc 2024-08-26 18:11:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2024:5871 https://access.redhat.com/errata/RHSA-2024:5871
Comment 14 errata-xmlrpc 2024-08-27 11:24:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Advanced Update Support

Via RHSA-2024:5894 https://access.redhat.com/errata/RHSA-2024:5894
Comment 15 errata-xmlrpc 2024-08-27 18:20:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2024:5907 https://access.redhat.com/errata/RHSA-2024:5907
Comment 16 errata-xmlrpc 2024-08-27 18:40:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2024:5908 https://access.redhat.com/errata/RHSA-2024:5908
Comment 17 errata-xmlrpc 2024-08-28 11:31:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2024:5930 https://access.redhat.com/errata/RHSA-2024:5930
Comment 19 errata-xmlrpc 2024-09-03 19:14:01 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.16

Via RHSA-2024:6004 https://access.redhat.com/errata/RHSA-2024:6004
Comment 20 errata-xmlrpc 2024-09-04 07:57:08 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2024:6009 https://access.redhat.com/errata/RHSA-2024:6009
Comment 21 errata-xmlrpc 2024-09-05 05:56:42 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.15

Via RHSA-2024:6013 https://access.redhat.com/errata/RHSA-2024:6013
Comment 22 errata-xmlrpc 2024-09-11 18:34:49 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2024:6406 https://access.redhat.com/errata/RHSA-2024:6406
Comment 24 errata-xmlrpc 2024-09-18 03:07:24 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2024:6642 https://access.redhat.com/errata/RHSA-2024:6642
Note You need to log in before you can comment on or make changes to this bug.