RHSA-2024:1789HighCVSS 7.5

Red Hat Security Advisory: bind security update

Published
April 11, 2024
Last Modified
August 6, 2026

🔗 CVE IDs covered (6)

CVE-2023-50868 →CVE-2023-4408 →CVE-2023-5517 →CVE-2023-5679 →CVE-2023-6516 →CVE-2023-50387 →

📋 Description

CVE-2023-4408 — bind9: Parsing large DNS messages may cause excessive CPU load CVE-2023-5517 — bind9: Querying RFC 1918 reverse zones may cause an assertion failure when “nxdomain-redirect” is enabled CVE-2023-5679 — bind9: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution CVE-2023-6516 — bind9: Specific recursive query patterns may lead to an out-of-memory condition CVE-2023-50387 — bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator CVE-2023-50868 — bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources

🎯 Affected products91

  • Red Hat CodeReady Linux Builder (v. 9)
  • Red Hat Enterprise Linux AppStream (v. 9)
  • bind-32:9.16.23-14.el9_3.4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-32:9.16.23-14.el9_3.4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-32:9.16.23-14.el9_3.4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-32:9.16.23-14.el9_3.4.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-32:9.16.23-14.el9_3.4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-chroot-32:9.16.23-14.el9_3.4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-chroot-32:9.16.23-14.el9_3.4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-chroot-32:9.16.23-14.el9_3.4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-chroot-32:9.16.23-14.el9_3.4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-debuginfo-32:9.16.23-14.el9_3.4.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind-debuginfo-32:9.16.23-14.el9_3.4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-debuginfo-32:9.16.23-14.el9_3.4.i686 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind-debuginfo-32:9.16.23-14.el9_3.4.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind-debuginfo-32:9.16.23-14.el9_3.4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-debuginfo-32:9.16.23-14.el9_3.4.s390x as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind-debuginfo-32:9.16.23-14.el9_3.4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-debuginfo-32:9.16.23-14.el9_3.4.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind-debuginfo-32:9.16.23-14.el9_3.4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-debugsource-32:9.16.23-14.el9_3.4.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind-debugsource-32:9.16.23-14.el9_3.4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-debugsource-32:9.16.23-14.el9_3.4.i686 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind-debugsource-32:9.16.23-14.el9_3.4.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind-debugsource-32:9.16.23-14.el9_3.4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-debugsource-32:9.16.23-14.el9_3.4.s390x as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind-debugsource-32:9.16.23-14.el9_3.4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-debugsource-32:9.16.23-14.el9_3.4.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind-debugsource-32:9.16.23-14.el9_3.4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-devel-32:9.16.23-14.el9_3.4.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • +61 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To prevent this vulnerability, ensure the `nxdomain-redirect` directive is not present in the `/etc/named.conf` file. Disabling the nxdomain-redirect feature makes the faulty code path impossible to reach, preventing this flaw from being exploitable. Workaround: This vulnerability can be mitigated by either disabled server-stale configuration, using both of the switches bellow in named configuration file: 1) set stale-cache-enable no; 2) set stale-answer-enable no; Alternatively, disable the DNS64 option. Both mitigations should make the affected code unreachable, making it impossible to an attacker to exploit this vulnerability. Workaround: There is no available mitigation for this issue other than applying the required fixes via the released updates. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (9)