Your submission was sent successfully! Close

CVE-2021-25219

Published: 27 October 2021

In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.

Priority

Medium

CVSS 3 base score: 5.3

Status

Package Release Status
bind9
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 21.10 (Impish Indri)
Released (1:9.16.15-1ubuntu1.1)
Ubuntu 21.04 (Hirsute Hippo)
Released (1:9.16.8-1ubuntu3.2)
Ubuntu 20.04 LTS (Focal Fossa)
Released (1:9.16.1-0ubuntu2.9)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (1:9.11.3+dfsg-1ubuntu1.16)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (1:9.10.3.dfsg.P4-8ubuntu1.19+esm1)
Ubuntu 14.04 ESM (Trusty Tahr)
Released (1:9.9.5.dfsg-3ubuntu0.19+esm5)