CVSS: 7.5EPSS: 0%CPEs: 34EXPL: 0CVE-2022-38177 – Memory leak in ECDSA DNSSEC verification code
https://notcve.org/view.php?id=CVE-2022-38177
By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources. Al falsificar el resolver objetivo con respuestas que presentan una firma ECDSA malformada, un atacante puede desencadenar una pequeña pérdida de memoria. Es posible erosionar gradualmente la memoria disponible hasta el punto de que named sea bloqueado por falta de recursos A flaw was found in the Bind package. By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak, resulting in crashing the program. • http://www.openwall.com/lists/oss-security/2022/09/21/3 https://kb.isc.org/docs/cve-2022-38177 https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-2906 – Memory leaks in code handling Diffie-Hellman key exchange via TKEY RRs (OpenSSL 3.0.0+ only)
https://notcve.org/view.php?id=CVE-2022-2906
An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service. Un atacante puede aprovechar este fallo para erosionar gradualmente la memoria disponible hasta el punto de que named sea bloqueado por falta de recursos. Al reiniciar, el atacante tendría que empezar de nuevo, pero sin embargo se presenta la posibilidad de denegar el servicio • http://www.openwall.com/lists/oss-security/2022/09/21/3 https://kb.isc.org/docs/cve-2022-2906 https://security.gentoo.org/glsa/202210-25 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 8.2EPSS: 0%CPEs: 2EXPL: 0CVE-2022-2881 – Buffer overread in statistics channel code
https://notcve.org/view.php?id=CVE-2022-2881
The underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process. Un fallo subyacente podría causar que sea leído más allá del final del buffer y que sea leída memoria que no debería leer, o que bloqueará el proceso • http://www.openwall.com/lists/oss-security/2022/09/21/3 https://kb.isc.org/docs/cve-2022-2881 https://security.gentoo.org/glsa/202210-25 • CWE-125: Out-of-bounds Read •
CVSS: 5.3EPSS: 0%CPEs: 35EXPL: 0CVE-2022-2795 – Processing large delegations may severely degrade resolver performance
https://notcve.org/view.php?id=CVE-2022-2795
By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service. Al inundar el resolvedor de destino con consultas que explotan este fallo, un atacante puede perjudicar significativamente el rendimiento del resolvedor, negando efectivamente a los clientes legítimos el acceso al servicio de resolución DNS A flaw was found in bind. When flooding the target resolver with special queries, an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service. • http://www.openwall.com/lists/oss-security/2022/09/21/3 https://kb.isc.org/docs/cve-2022-2795 https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5S • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2022-1183 – Destroying a TLS session early causes assertion failure
https://notcve.org/view.php?id=CVE-2022-1183
On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that include a reference to http within the listen-on statements in their named.conf. TLS is used by both DNS over TLS (DoT) and DNS over HTTPS (DoH), but configurations using DoT alone are unaffected. Affects BIND 9.18.0 -> 9.18.2 and version 9.19.0 of the BIND 9.19 development branch. En configuraciones vulnerables, el demonio nombrado puede, en algunas circunstancias, terminar con un fallo de aserción. • https://kb.isc.org/docs/cve-2022-1183 https://security.netapp.com/advisory/ntap-20220707-0002 • CWE-617: Reachable Assertion •