CVE-2021-25219

27.10.2021, 21:15

In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
isc	CNA	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 65%

Vendor	Product	Version
isc	bind	9.3.0 ≤ 𝑥 < 9.11.36
isc	bind	9.12.0 ≤ 𝑥 < 9.16.22
isc	bind	9.17.0 ≤ 𝑥 < 9.17.19
isc	bind	9.9.3:s1
isc	bind	9.9.12:s1
isc	bind	9.9.13:s1
isc	bind	9.10.5:s1
isc	bind	9.10.7:s1
isc	bind	9.11.3:s1
isc	bind	9.11.5:s3
isc	bind	9.11.5:s5
isc	bind	9.11.5:s6
isc	bind	9.11.6:s1
isc	bind	9.11.7:s1
isc	bind	9.11.8:s1
isc	bind	9.11.12:s1
isc	bind	9.11.21:s1
isc	bind	9.11.27:s1
isc	bind	9.11.29:s1
isc	bind	9.11.35:s1
isc	bind	9.16.8:s1
isc	bind	9.16.11:s1
isc	bind	9.16.13:s1
isc	bind	9.16.21:s1
debian	debian_linux	9.0
debian	debian_linux	10.0
debian	debian_linux	11.0
netapp	h300s_firmware	-
netapp	h500s_firmware	-
netapp	h700s_firmware	-
netapp	h300e_firmware	-
netapp	h500e_firmware	-
netapp	h700e_firmware	-
netapp	h410s_firmware	-
netapp	h410c_firmware	-
netapp	cloud_backup	-
siemens	sinec_infrastructure_network_services	𝑥 < 1.0.1.1
oracle	http_server	12.2.1.3.0
oracle	http_server	12.2.1.4.0
oracle	zfs_storage_appliance_kit	8.8

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

bind9

bullseye	1:9.16.50-1~deb11u2 fixed
bullseye (security)	1:9.16.50-1~deb11u1 fixed
bookworm	1:9.18.28-1~deb12u2 fixed
bookworm (security)	1:9.18.28-1~deb12u2 fixed
sid	1:9.20.2-1 fixed
trixie	1:9.20.2-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

bind9

jammy	Fixed 1:9.16.15-1ubuntu2 released
impish	Fixed 1:9.16.15-1ubuntu1.1 released
hirsute	Fixed 1:9.16.8-1ubuntu3.2 released
focal	Fixed 1:9.16.1-0ubuntu2.9 released
bionic	Fixed 1:9.11.3+dfsg-1ubuntu1.16 released
xenial	Fixed 1:9.10.3.dfsg.P4-8ubuntu1.19+esm1 released
trusty	Fixed 1:9.9.5.dfsg-3ubuntu0.19+esm5 released