Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2022-3080

Summary
Assigner-isc
Assigner Org ID-404fd4d2-a609-4245-b543-2c944a302a22
Published At-21 Sep, 2022 | 10:15
Updated At-17 Sep, 2024 | 01:56
Rejected At-
Credits

BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly

By sending specific queries to the resolver, an attacker can cause named to crash.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:isc
Assigner Org ID:404fd4d2-a609-4245-b543-2c944a302a22
Published At:21 Sep, 2022 | 10:15
Updated At:17 Sep, 2024 | 01:56
Rejected At:
▼CVE Numbering Authority (CNA)
BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly

By sending specific queries to the resolver, an attacker can cause named to crash.

Affected Products
Vendor
Internet Systems Consortium, Inc.ISC
Product
BIND9
Versions
Affected
  • Open Source Branch 9.16 9.16.14 through versions before 9.16.33
  • Open Source Branch 9.18 9.18.0 through versions before 9.18.7
  • Supported Preview Branch 9.16-S 9.16.14-S1 through versions before 9.16.33-S1
  • Development Branch 9.19 9.19.0 through versions before 9.19.5
Problem Types
TypeCWE IDDescription
textN/AIn BIND 9.16.14 -> 9.16.32, 9.18.0 -> 9.18.6, versions 9.16.14-S1 -> 9.16.32-S1 of the BIND Supported Preview Edition, and versions 9.19.0 -> 9.19.4 of the BIND 9.19 development branch, a BIND 9 resolver can crash when stale cache and stale answers are enabled, option stale-answer-client-timeout is set to 0 and there is a stale CNAME in the cache for an incoming query.
Type: text
CWE ID: N/A
Description: In BIND 9.16.14 -> 9.16.32, 9.18.0 -> 9.18.6, versions 9.16.14-S1 -> 9.16.32-S1 of the BIND Supported Preview Edition, and versions 9.19.0 -> 9.19.4 of the BIND 9.19 development branch, a BIND 9 resolver can crash when stale cache and stale answers are enabled, option stale-answer-client-timeout is set to 0 and there is a stale CNAME in the cache for an incoming query.
Metrics
VersionBase scoreBase severityVector
3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Upgrade to the patched release most closely related to your current version of BIND: BIND 9.16.33, BIND 9.18.7, BIND 9.19.5, or for BIND Supported Preview Edition (a special feature preview branch of BIND provided to eligible ISC support customers): BIND 9.16.33-S1.

Configurations
Workarounds

Setting stale-answer-client-timeout to off or to an integer greater than 0 will prevent BIND from crashing due to this issue.

Exploits

We are not aware of any active exploits.

Credits
ISC would like to thank Maksym Odinintsev for bringing this vulnerability to our attention.
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://kb.isc.org/docs/cve-2022-3080
N/A
http://www.openwall.com/lists/oss-security/2022/09/21/3
mailing-list
https://www.debian.org/security/2022/dsa-5235
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/
vendor-advisory
https://security.gentoo.org/glsa/202210-25
vendor-advisory
https://security.netapp.com/advisory/ntap-20240621-0002/
N/A
Hyperlink: https://kb.isc.org/docs/cve-2022-3080
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2022/09/21/3
Resource:
mailing-list
Hyperlink: https://www.debian.org/security/2022/dsa-5235
Resource:
vendor-advisory
Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/
Resource:
vendor-advisory
Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/
Resource:
vendor-advisory
Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/
Resource:
vendor-advisory
Hyperlink: https://security.gentoo.org/glsa/202210-25
Resource:
vendor-advisory
Hyperlink: https://security.netapp.com/advisory/ntap-20240621-0002/
Resource: N/A
▼Authorized Data Publishers (ADP)
1. CISA ADP Vulnrichment
Affected Products
Vendor
Fedora Projectfedoraproject
Product
fedora
CPEs
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 35
Vendor
Fedora Projectfedoraproject
Product
fedora
CPEs
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 36
Vendor
Fedora Projectfedoraproject
Product
fedora
CPEs
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 37
Vendor
Internet Systems Consortium, Inc.isc
Product
bind
CPEs
  • cpe:2.3:a:isc:bind:9.16.14:-:*:*:*:*:*:*
  • cpe:2.3:a:isc:bind:9.16.14:s1:*:*:supported_preview:*:*:*
  • cpe:2.3:a:isc:bind:9.16.21:s1:*:*:supported_preview:*:*:*
  • cpe:2.3:a:isc:bind:9.16.32:s1:*:*:supported_preview:*:*:*
  • cpe:2.3:a:isc:bind:9.18.0:*:*:*:-:*:*:*
  • cpe:2.3:a:isc:bind:9.19.0:*:*:*:-:*:*:*
Default Status
unknown
Versions
Affected
  • From 9.16.14 before 9.16.33 (custom)
  • 9.16.14
  • 9.16.21
  • 9.16.32
  • From 9.18.0 before 9.18.7 (custom)
  • From 9.19.0 before 9.19.5 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-613CWE-613 Insufficient Session Expiration
Type: CWE
CWE ID: CWE-613
Description: CWE-613 Insufficient Session Expiration
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
2. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://kb.isc.org/docs/cve-2022-3080
x_transferred
http://www.openwall.com/lists/oss-security/2022/09/21/3
mailing-list
x_transferred
https://www.debian.org/security/2022/dsa-5235
vendor-advisory
x_transferred
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/
vendor-advisory
x_transferred
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/
vendor-advisory
x_transferred
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/
vendor-advisory
x_transferred
https://security.gentoo.org/glsa/202210-25
vendor-advisory
x_transferred
https://security.netapp.com/advisory/ntap-20240621-0002/
x_transferred
Hyperlink: https://kb.isc.org/docs/cve-2022-3080
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2022/09/21/3
Resource:
mailing-list
x_transferred
Hyperlink: https://www.debian.org/security/2022/dsa-5235
Resource:
vendor-advisory
x_transferred
Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/
Resource:
vendor-advisory
x_transferred
Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/
Resource:
vendor-advisory
x_transferred
Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/
Resource:
vendor-advisory
x_transferred
Hyperlink: https://security.gentoo.org/glsa/202210-25
Resource:
vendor-advisory
x_transferred
Hyperlink: https://security.netapp.com/advisory/ntap-20240621-0002/
Resource:
x_transferred
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:security-officer@isc.org
Published At:21 Sep, 2022 | 11:15
Updated At:03 Jul, 2024 | 01:38

By sending specific queries to the resolver, an attacker can cause named to crash.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Secondary3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Type: Primary
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Type: Secondary
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CPE Matches
Internet Systems Consortium, Inc.
isc
>>bind>>Versions from 9.16.14(inclusive) to 9.16.33(exclusive)
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*
Internet Systems Consortium, Inc.
isc
>>bind>>Versions from 9.18.0(inclusive) to 9.18.7(exclusive)
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*
Internet Systems Consortium, Inc.
isc
>>bind>>Versions from 9.19.0(inclusive) to 9.19.5(exclusive)
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*
Internet Systems Consortium, Inc.
isc
>>bind>>9.16.14
cpe:2.3:a:isc:bind:9.16.14:s1:*:*:supported_preview:*:*:*
Internet Systems Consortium, Inc.
isc
>>bind>>9.16.21
cpe:2.3:a:isc:bind:9.16.21:s1:*:*:supported_preview:*:*:*
Internet Systems Consortium, Inc.
isc
>>bind>>9.16.32
cpe:2.3:a:isc:bind:9.16.32:s1:*:*:supported_preview:*:*:*
Fedora Project
fedoraproject
>>fedora>>35
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Fedora Project
fedoraproject
>>fedora>>36
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
Fedora Project
fedoraproject
>>fedora>>37
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
NVD-CWE-noinfoPrimarynvd@nist.gov
CWE-613Secondary134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE ID: NVD-CWE-noinfo
Type: Primary
Source: nvd@nist.gov
CWE ID: CWE-613
Type: Secondary
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
http://www.openwall.com/lists/oss-security/2022/09/21/3security-officer@isc.org
Mailing List
Patch
Third Party Advisory
https://kb.isc.org/docs/cve-2022-3080security-officer@isc.org
Patch
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/security-officer@isc.org
N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/security-officer@isc.org
N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/security-officer@isc.org
N/A
https://security.gentoo.org/glsa/202210-25security-officer@isc.org
Third Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0002/security-officer@isc.org
N/A
https://www.debian.org/security/2022/dsa-5235security-officer@isc.org
Third Party Advisory
Hyperlink: http://www.openwall.com/lists/oss-security/2022/09/21/3
Source: security-officer@isc.org
Resource:
Mailing List
Patch
Third Party Advisory
Hyperlink: https://kb.isc.org/docs/cve-2022-3080
Source: security-officer@isc.org
Resource:
Patch
Vendor Advisory
Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/
Source: security-officer@isc.org
Resource: N/A
Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/
Source: security-officer@isc.org
Resource: N/A
Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/
Source: security-officer@isc.org
Resource: N/A
Hyperlink: https://security.gentoo.org/glsa/202210-25
Source: security-officer@isc.org
Resource:
Third Party Advisory
Hyperlink: https://security.netapp.com/advisory/ntap-20240621-0002/
Source: security-officer@isc.org
Resource: N/A
Hyperlink: https://www.debian.org/security/2022/dsa-5235
Source: security-officer@isc.org
Resource:
Third Party Advisory

Change History

0
Information is not available yet

Similar CVEs

0Records found
Details not found