RHSA-2024:1648HighCVSS 7.5

Red Hat Security Advisory: bind9.16 security update

Published
April 2, 2024
Last Modified
August 6, 2026

🔗 CVE IDs covered (6)

CVE-2023-4408 →CVE-2023-5517 →CVE-2023-5679 →CVE-2023-6516 →CVE-2023-50387 →CVE-2023-50868 →

📋 Description

CVE-2023-4408 — bind9: Parsing large DNS messages may cause excessive CPU load CVE-2023-5517 — bind9: Querying RFC 1918 reverse zones may cause an assertion failure when “nxdomain-redirect” is enabled CVE-2023-5679 — bind9: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution CVE-2023-6516 — bind9: Specific recursive query patterns may lead to an out-of-memory condition CVE-2023-50387 — bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator CVE-2023-50868 — bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources

🎯 Affected products77

  • Red Hat CodeReady Linux Builder EUS (v.8.8)
  • Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind9.16-32:9.16.23-0.14.el8_8.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind9.16-32:9.16.23-0.14.el8_8.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind9.16-32:9.16.23-0.14.el8_8.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind9.16-32:9.16.23-0.14.el8_8.4.src as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind9.16-32:9.16.23-0.14.el8_8.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind9.16-chroot-32:9.16.23-0.14.el8_8.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind9.16-chroot-32:9.16.23-0.14.el8_8.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind9.16-chroot-32:9.16.23-0.14.el8_8.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind9.16-chroot-32:9.16.23-0.14.el8_8.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind9.16-debuginfo-32:9.16.23-0.14.el8_8.4.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.8.8)
  • bind9.16-debuginfo-32:9.16.23-0.14.el8_8.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind9.16-debuginfo-32:9.16.23-0.14.el8_8.4.i686 as a component of Red Hat CodeReady Linux Builder EUS (v.8.8)
  • bind9.16-debuginfo-32:9.16.23-0.14.el8_8.4.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.8.8)
  • bind9.16-debuginfo-32:9.16.23-0.14.el8_8.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind9.16-debuginfo-32:9.16.23-0.14.el8_8.4.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.8.8)
  • bind9.16-debuginfo-32:9.16.23-0.14.el8_8.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind9.16-debuginfo-32:9.16.23-0.14.el8_8.4.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.8.8)
  • bind9.16-debuginfo-32:9.16.23-0.14.el8_8.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind9.16-debugsource-32:9.16.23-0.14.el8_8.4.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.8.8)
  • bind9.16-debugsource-32:9.16.23-0.14.el8_8.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind9.16-debugsource-32:9.16.23-0.14.el8_8.4.i686 as a component of Red Hat CodeReady Linux Builder EUS (v.8.8)
  • bind9.16-debugsource-32:9.16.23-0.14.el8_8.4.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v.8.8)
  • bind9.16-debugsource-32:9.16.23-0.14.el8_8.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind9.16-debugsource-32:9.16.23-0.14.el8_8.4.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.8.8)
  • bind9.16-debugsource-32:9.16.23-0.14.el8_8.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind9.16-debugsource-32:9.16.23-0.14.el8_8.4.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v.8.8)
  • bind9.16-debugsource-32:9.16.23-0.14.el8_8.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • bind9.16-devel-32:9.16.23-0.14.el8_8.4.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v.8.8)
  • +47 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To prevent this vulnerability, ensure the `nxdomain-redirect` directive is not present in the `/etc/named.conf` file. Disabling the nxdomain-redirect feature makes the faulty code path impossible to reach, preventing this flaw from being exploitable. Workaround: This vulnerability can be mitigated by either disabled server-stale configuration, using both of the switches bellow in named configuration file: 1) set stale-cache-enable no; 2) set stale-answer-enable no; Alternatively, disable the DNS64 option. Both mitigations should make the affected code unreachable, making it impossible to an attacker to exploit this vulnerability. Workaround: There is no available mitigation for this issue other than applying the required fixes via the released updates. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (9)