| Package | Affected versions | Patched versions |
|---|---|---|
| bind | ≥ 9.0.0, < 9.16.48≥ 9.18.0, < 9.18.24≥ 9.18.11, < 9.18.24≥ 9.19.0, < 9.19.21≥ 9.9.3, < 9.16.48 | 9.16.489.18.249.19.21 |
| recursor | ≥ 4.9.0, < 4.9.3≥ 5.0.0, < 5.0.2< 4.8.5 | 4.9.35.0.24.8.5 |
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free