Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2022-3080
PUBLISHED
More InfoOfficial Page
Assigner-isc
Assigner Org ID-404fd4d2-a609-4245-b543-2c944a302a22
View Known Exploited Vulnerability (KEV) details
Published At-21 Sep, 2022 | 10:15
Updated At-17 Sep, 2024 | 01:56
Rejected At-
▼CVE Numbering Authority (CNA)
BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly

By sending specific queries to the resolver, an attacker can cause named to crash.

Affected Products
Vendor
Internet Systems Consortium, Inc.ISC
Product
BIND9
Versions
Affected
  • Open Source Branch 9.16 9.16.14 through versions before 9.16.33
  • Open Source Branch 9.18 9.18.0 through versions before 9.18.7
  • Supported Preview Branch 9.16-S 9.16.14-S1 through versions before 9.16.33-S1
  • Development Branch 9.19 9.19.0 through versions before 9.19.5
Problem Types
TypeCWE IDDescription
textN/AIn BIND 9.16.14 -> 9.16.32, 9.18.0 -> 9.18.6, versions 9.16.14-S1 -> 9.16.32-S1 of the BIND Supported Preview Edition, and versions 9.19.0 -> 9.19.4 of the BIND 9.19 development branch, a BIND 9 resolver can crash when stale cache and stale answers are enabled, option stale-answer-client-timeout is set to 0 and there is a stale CNAME in the cache for an incoming query.
Metrics
VersionBase scoreBase severityVector
3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Upgrade to the patched release most closely related to your current version of BIND: BIND 9.16.33, BIND 9.18.7, BIND 9.19.5, or for BIND Supported Preview Edition (a special feature preview branch of BIND provided to eligible ISC support customers): BIND 9.16.33-S1.

Configurations
Workarounds

Setting stale-answer-client-timeout to off or to an integer greater than 0 will prevent BIND from crashing due to this issue.

Exploits

We are not aware of any active exploits.

Credits
ISC would like to thank Maksym Odinintsev for bringing this vulnerability to our attention.
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://kb.isc.org/docs/cve-2022-3080
N/A
http://www.openwall.com/lists/oss-security/2022/09/21/3
mailing-list
https://www.debian.org/security/2022/dsa-5235
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/
vendor-advisory
https://security.gentoo.org/glsa/202210-25
vendor-advisory
https://security.netapp.com/advisory/ntap-20240621-0002/
N/A
▼Authorized Data Publishers (ADP)
1. CISA ADP Vulnrichment
Affected Products
Vendor
Fedora Projectfedoraproject
Product
fedora
CPEs
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 35
Vendor
Fedora Projectfedoraproject
Product
fedora
CPEs
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 36
Vendor
Fedora Projectfedoraproject
Product
fedora
CPEs
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 37
Vendor
Internet Systems Consortium, Inc.isc
Product
bind
CPEs
  • cpe:2.3:a:isc:bind:9.16.14:-:*:*:*:*:*:*
  • cpe:2.3:a:isc:bind:9.16.14:s1:*:*:supported_preview:*:*:*
  • cpe:2.3:a:isc:bind:9.16.21:s1:*:*:supported_preview:*:*:*
  • cpe:2.3:a:isc:bind:9.16.32:s1:*:*:supported_preview:*:*:*
  • cpe:2.3:a:isc:bind:9.18.0:*:*:*:-:*:*:*
  • cpe:2.3:a:isc:bind:9.19.0:*:*:*:-:*:*:*
Default Status
unknown
Versions
Affected
  • From 9.16.14 before 9.16.33 (custom)
  • 9.16.14
  • 9.16.21
  • 9.16.32
  • From 9.18.0 before 9.18.7 (custom)
  • From 9.19.0 before 9.19.5 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-613CWE-613 Insufficient Session Expiration
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
2. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://kb.isc.org/docs/cve-2022-3080
x_transferred
http://www.openwall.com/lists/oss-security/2022/09/21/3
mailing-list
x_transferred
https://www.debian.org/security/2022/dsa-5235
vendor-advisory
x_transferred
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/
vendor-advisory
x_transferred
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/
vendor-advisory
x_transferred
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/
vendor-advisory
x_transferred
https://security.gentoo.org/glsa/202210-25
vendor-advisory
x_transferred
https://security.netapp.com/advisory/ntap-20240621-0002/
x_transferred
Details not found