[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] ISC has disclosed two vulnerabilities in BIND 9 (CVE-2023-2828, CVE-2023-2911)
From:       Michał Kępień <michal () isc ! org>
Date:       2023-06-21 16:12:26
Message-ID: ZJMhapAB3v_6YLmg () larwa ! hq ! kempniu ! pl
[Download RAW message or body]

On 21 June 2023 we (Internet Systems Consortium) disclosed two vulnerabilities affecting our \
BIND 9 software:

- CVE-2023-2828:        named's configured cache size limit can be significantly exceeded \
                https://kb.isc.org/docs/cve-2023-2828
- CVE-2023-2911:        Exceeding the recursive-clients quota may cause named to terminate \
unexpectedly when stale-answer-client-timeout is set to 0 https://kb.isc.org/docs/cve-2023-2911

New versions of BIND 9 are available from https://www.isc.org/downloads

Operators and package maintainers who prefer to apply patches selectively can find individual \
vulnerability-specific patches in the "patches" subdirectory of each published release \
directory:

- https://downloads.isc.org/isc/bind9/9.16.42/patches/
- https://downloads.isc.org/isc/bind9/9.18.16/patches/
- https://downloads.isc.org/isc/bind9/9.19.14/patches/

With the public announcement of these vulnerabilities, the embargo period is ended and any \
updated software packages that have been prepared may be released.

-- 
Best regards,
Michał Kępień


[prev in list] [next in list] [prev in thread] [next in thread]