CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2022-3080 – BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly
https://notcve.org/view.php?id=CVE-2022-3080
21 Sep 2022 — By sending specific queries to the resolver, an attacker can cause named to crash. Mediante el envío de consultas específicas al resolver, un atacante puede causar la caída de named A flaw was found in the Bind package, where the resolver can crash when stale cache and stale answers are enabled, option stale-answer-client-timeout is set to 0 and there is a stale CNAME in the cache for an incoming query. By sending specific queries to the resolver, an attacker can cause named to crash. Yehuda Afek, Anat Brem... • http://www.openwall.com/lists/oss-security/2022/09/21/3 • CWE-20: Improper Input Validation CWE-613: Insufficient Session Expiration •
CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2022-1183 – Destroying a TLS session early causes assertion failure
https://notcve.org/view.php?id=CVE-2022-1183
19 May 2022 — On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that include a reference to http within the listen-on statements in their named.conf. TLS is used by both DNS over TLS (DoT) and DNS over HTTPS (DoH), but configurations using DoT alone are unaffected. Affects BIND 9.18.0 -> 9.18.2 and version 9.19.0 of the BIND 9.19 development branch. En configuraciones vulnerables, el demonio nombrado puede, en algunas circun... • https://kb.isc.org/docs/cve-2022-1183 • CWE-617: Reachable Assertion •