ALT-PU-2022-1501

Высокий

ALT-PU-2022-1501: package bind update to version 9.11.37-alt1

Источник

errata.altlinux.org

Дата публикации

17.03.2022

Дата обновления

17.03.2022

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

Описание

This update upgrades bind to version 9.11.37-alt1.

Устраненные уязвимости2

BDU:2022-05754

Высокий 8.6

Дата публикации: 16.09.2022

Уязвимость сервера DNS BIND, связанная с недостатками обработки HTTP-запросов, позволяющая нарушителю оказать воздействие на целостность данных

CVSS 3.1

Высокий 8.6

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Changed
Confidentiality: None
Integrity: High
Availability: None

CVSS 2.0

Высокий 7.8

AV:N/AC:L/Au:N/C:N/I:C/A:N

Access vector: Network
Complexity: Low
Authentication: None
Confidentiality: None
Integrity: Complete
Availability: None

Ссылки

BDU:2022-05754 https://bdu.fstec.ru/vul/2022-05754

Ссылки1

ALT-PU-2022-1501 https://errata.altlinux.org/ALT-PU-2022-1501

Связанные уязвимости

CVE-2021-25220

CVSS3: 6.8

ubuntu

больше 4 лет назад

BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.