---
title: "CVE-2019-6475\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2019-6475?format=md
keywords: index, follow
---

# CVE-2019-6475

Publication date 16 October 2019

Last updated 25 August 2025

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**7.5 · High**

[Score breakdown](https://ubuntu.com/security/CVE-2019-6475?format=md#impact-score)

Toggle side navigation

## Description

Mirror zones are a BIND feature allowing recursive servers to pre-cache
zone data provided by other servers. A mirror zone is similar to a zone of
type secondary, except that its data is subject to DNSSEC validation before
being used in answers, as if it had been looked up via traditional
recursion, and when mirror zone data cannot be validated, BIND falls back
to using traditional recursion instead of the mirror zone. However, an
error in the validity checks for the incoming zone data can allow an
on-path attacker to replace zone data that was validated with a configured
trust anchor with forged data of the attacker's choosing. The mirror zone
feature is most often used to serve a local copy of the root zone. If an
attacker was able to insert themselves into the network path between a
recursive server using a mirror zone and a root name server, this
vulnerability could then be used to cause the recursive server to accept a
copy of falsified root zone data. This affects BIND versions 9.14.0 up to
9.14.6, and 9.15.0 up to 9.15.4.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2019-6475?format=md#notes)

## Mitigation

The vulnerability can be avoided by disabling QNAME minimization using
"qname-minimization disabled;" in the global options section of named.conf

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| bind9 | 19.04 disco | Not affected |
| 18.04 LTS bionic | Not affected |
| 16.04 LTS xenial | Not affected |
| 14.04 LTS trusty | Not affected |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Notes

---

### [alexmurray](https://launchpad.net/~alexmurray)

Only affects versions 9.14.0 -> 9.14.6

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

7.5 · High

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | None |
  | Integrity impact | High |
  | Availability impact | None |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 7.5 · High |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6475)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-6475)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2019-6475)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2019-6475)

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2019-6475>