Vulnerability · Published Aug 21, 2020 · Assigned by isc
CVE-2020-8620
High 7.5
In plain English
A high-severity security flaw in BIND9 from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)3.9%top 9.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to trigger the assertion failure, causing the server to exit.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | bind | 9.16.6-r0 | ALPINE-CVE-2020-8620 |
| Alpine:v3.21 | bind | 9.16.6-r0 | ALPINE-CVE-2020-8620 |
| Alpine:v3.22 | bind | 9.16.6-r0 | ALPINE-CVE-2020-8620 |
| Alpine:v3.23 | bind | 9.16.6-r0 | ALPINE-CVE-2020-8620 |
| Alpine:v3.24 | bind | 9.16.6-r0 | ALPINE-CVE-2020-8620 |
| Debian:12 | bind9 | 1:9.16.6-1 | DEBIAN-CVE-2020-8620 |
| Debian:13 | bind9 | 1:9.16.6-1 | DEBIAN-CVE-2020-8620 |
| Debian:14 | bind9 | 1:9.16.6-1 | DEBIAN-CVE-2020-8620 |
Affected products (as reported)
References
- https://kb.isc.org/docs/cve-2020-8620 x_refsource_CONFIRM
- https://security.netapp.com/advisory/ntap-20200827-0003/ x_refsource_CONFIRM
- USN-4468-1 vendor-advisory, x_refsource_UBUNTU
- GLSA-202008-19 vendor-advisory, x_refsource_GENTOO
- https://www.synology.com/security/advisory/Synology_SA_20_19 x_refsource_CONFIRM
- openSUSE-SU-2020:1699 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2020:1701 vendor-advisory, x_refsource_SUSE