Debian Security Advisory
DLA-2355-1 bind9 -- LTS security update
- Date Reported:
- 29 Aug 2020
- Affected Packages:
- Security database references:
- In Mitre's CVE dictionary: CVE-2020-8622, CVE-2020-8623.
- More information:
Two issues have been found in bind9, an Internet Domain Name Server.
Crafted responses to TSIG-signed requests could lead to an assertion failure, causing the server to exit. This could be done by malicious server operators or guessing attackers.
An assertions failure, causing the server to exit, can be exploited by a query for an RSA signed zone.
For Debian 9 stretch, these problems have been fixed in version 1:9.10.3.dfsg.P4-12.3+deb9u7.
We recommend that you upgrade your bind9 packages.
For the detailed security status of bind9 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/bind9
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS