CVE-2023-4236

Опубликовано: 20 сент. 2023

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

A flaw in the networking code handling DNS-over-TLS queries may cause named to terminate unexpectedly due to an assertion failure. This happens when internal data structures are incorrectly reused under significant DNS-over-TLS query load. This issue affects BIND 9 versions 9.18.0 through 9.18.18 and 9.18.11-S1 through 9.18.18-S1.

Ссылки

http://www.openwall.com/lists/oss-security/2023/09/20/2
Mailing List
Third Party Advisory
https://kb.isc.org/docs/cve-2023-4236
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPJLLTJCSDJJII7IIZPLTBQNWP7MZH7F/
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U35OARLQCPMVCBBPHWBXY5M6XJLD2TZ5/
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSK5V4W4OHPM3JTJGWAQD6CZW7SFD75B/
Mailing List
Third Party Advisory
https://security.netapp.com/advisory/ntap-20231013-0004/
Third Party Advisory
https://www.debian.org/security/2023/dsa-5504
Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/20/2
Mailing List
Third Party Advisory
https://kb.isc.org/docs/cve-2023-4236
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPJLLTJCSDJJII7IIZPLTBQNWP7MZH7F/
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U35OARLQCPMVCBBPHWBXY5M6XJLD2TZ5/
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSK5V4W4OHPM3JTJGWAQD6CZW7SFD75B/
Mailing List
Third Party Advisory
https://security.netapp.com/advisory/ntap-20231013-0004/
Third Party Advisory
https://www.debian.org/security/2023/dsa-5504
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*

Версия от 9.18.0 (включая) до 9.18.18 (исключая)

cpe:2.3:a:isc:bind:9.18.11:s1:*:*:supported_preview:*:*:*

cpe:2.3:a:isc:bind:9.18.18:s1:*:*:supported_preview:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Конфигурация 6

Одновременно

cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Конфигурация 7

Одновременно

cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Конфигурация 8

Одновременно

cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

EPSS

Процентиль: 34%

0.0013

Низкий

7.5 High

CVSS3

Дефекты

CWE-617

Связанные уязвимости

CVE-2023-4236

CVSS3: 7.5

ubuntu

почти 2 года назад

A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal data structures are incorrectly reused under significant DNS-over-TLS query load. This issue affects BIND 9 versions 9.18.0 through 9.18.18 and 9.18.11-S1 through 9.18.18-S1.

CVE-2023-4236

CVSS3: 7.5

redhat

почти 2 года назад

CVE-2023-4236

CVSS3: 7.5

debian

почти 2 года назад

A flaw in the networking code handling DNS-over-TLS queries may cause ...

GHSA-jhh4-vhhc-xpjq

CVSS3: 7.5

github

почти 2 года назад

BDU:2023-06007

CVSS3: 7.5

fstec

почти 2 года назад

Уязвимость реализации протокола DoT (DNS over TLS) DNS-сервера BIND, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 34%

0.0013

Низкий

7.5 High

CVSS3

Дефекты

CWE-617