Vulnerability · Published Mar 23, 2022 · Assigned by isc
CVE-2021-25220DNS forwarders - cache poisoning vulnerability
Medium 6.8
In plain English
A medium-severity security flaw in BIND from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.5% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)3.5%top 10.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | bind | 32:9.11.36-5.el8 | ALSA-2022:7790 |
| AlmaLinux:9 | bind | 32:9.16.23-5.el9_1 | ALSA-2022:8068 |
| AlmaLinux:8 | bind-chroot | 32:9.11.36-5.el8 | ALSA-2022:7790 |
| AlmaLinux:9 | bind-chroot | 32:9.16.23-5.el9_1 | ALSA-2022:8068 |
| AlmaLinux:8 | bind-devel | 32:9.11.36-5.el8 | ALSA-2022:7790 |
| AlmaLinux:9 | bind-devel | 32:9.16.23-5.el9_1 | ALSA-2022:8068 |
| AlmaLinux:9 | bind-dnssec-doc | 32:9.16.23-5.el9_1 | ALSA-2022:8068 |
| AlmaLinux:9 | bind-dnssec-utils | 32:9.16.23-5.el9_1 | ALSA-2022:8068 |
| AlmaLinux:9 | bind-doc | 32:9.16.23-5.el9_1 | ALSA-2022:8068 |
| AlmaLinux:8 | bind-export-devel | 32:9.11.36-5.el8 | ALSA-2022:7790 |
| AlmaLinux:8 | bind-export-libs | 32:9.11.36-5.el8 | ALSA-2022:7790 |
| AlmaLinux:8 | bind-libs | 32:9.11.36-5.el8 | ALSA-2022:7790 |
| AlmaLinux:9 | bind-libs | 32:9.16.23-5.el9_1 | ALSA-2022:8068 |
| AlmaLinux:8 | bind-libs-lite | 32:9.11.36-5.el8 | ALSA-2022:7790 |
| AlmaLinux:8 | bind-license | 32:9.11.36-5.el8 | ALSA-2022:7790 |
| AlmaLinux:9 | bind-license | 32:9.16.23-5.el9_1 | ALSA-2022:8068 |
| AlmaLinux:8 | bind-lite-devel | 32:9.11.36-5.el8 | ALSA-2022:7790 |
| AlmaLinux:8 | bind-pkcs11 | 32:9.11.36-5.el8 | ALSA-2022:7790 |
| AlmaLinux:8 | bind-pkcs11-devel | 32:9.11.36-5.el8 | ALSA-2022:7790 |
| AlmaLinux:8 | bind-pkcs11-libs | 32:9.11.36-5.el8 | ALSA-2022:7790 |
| AlmaLinux:8 | bind-pkcs11-utils | 32:9.11.36-5.el8 | ALSA-2022:7790 |
| AlmaLinux:8 | bind-sdb | 32:9.11.36-5.el8 | ALSA-2022:7790 |
| AlmaLinux:8 | bind-sdb-chroot | 32:9.11.36-5.el8 | ALSA-2022:7790 |
| AlmaLinux:8 | bind-utils | 32:9.11.36-5.el8 | ALSA-2022:7790 |
| AlmaLinux:9 | bind-utils | 32:9.16.23-5.el9_1 | ALSA-2022:8068 |
| AlmaLinux:8 | bind9.16 | 32:9.16.23-0.9.el8.1 | ALSA-2022:7643 |
| AlmaLinux:8 | bind9.16-chroot | 32:9.16.23-0.9.el8.1 | ALSA-2022:7643 |
| AlmaLinux:8 | bind9.16-devel | 32:9.16.23-0.9.el8.1 | ALSA-2022:7643 |
| AlmaLinux:8 | bind9.16-dnssec-utils | 32:9.16.23-0.9.el8.1 | ALSA-2022:7643 |
| AlmaLinux:8 | bind9.16-doc | 32:9.16.23-0.9.el8.1 | ALSA-2022:7643 |
| AlmaLinux:8 | bind9.16-libs | 32:9.16.23-0.9.el8.1 | ALSA-2022:7643 |
| AlmaLinux:8 | bind9.16-license | 32:9.16.23-0.9.el8.1 | ALSA-2022:7643 |
| AlmaLinux:8 | bind9.16-utils | 32:9.16.23-0.9.el8.1 | ALSA-2022:7643 |
| AlmaLinux:9 | dhcp-client | 12:4.4.2-17.b1.el9 | ALSA-2022:8385 |
| AlmaLinux:9 | dhcp-common | 12:4.4.2-17.b1.el9 | ALSA-2022:8385 |
| AlmaLinux:9 | dhcp-relay | 12:4.4.2-17.b1.el9 | ALSA-2022:8385 |
| AlmaLinux:9 | dhcp-server | 12:4.4.2-17.b1.el9 | ALSA-2022:8385 |
| AlmaLinux:8 | python3-bind | 32:9.11.36-5.el8 | ALSA-2022:7790 |
| AlmaLinux:9 | python3-bind | 32:9.16.23-5.el9_1 | ALSA-2022:8068 |
| AlmaLinux:8 | python3-bind9.16 | 32:9.16.23-0.9.el8.1 | ALSA-2022:7643 |
| Alpine:v3.20 | bind | 9.16.27-r0 | ALPINE-CVE-2021-25220 |
| Alpine:v3.21 | bind | 9.16.27-r0 | ALPINE-CVE-2021-25220 |
| Alpine:v3.22 | bind | 9.16.27-r0 | ALPINE-CVE-2021-25220 |
| Alpine:v3.23 | bind | 9.16.27-r0 | ALPINE-CVE-2021-25220 |
| Alpine:v3.24 | bind | 9.16.27-r0 | ALPINE-CVE-2021-25220 |
| Debian:12 | bind9 | 1:9.18.1-1 | DEBIAN-CVE-2021-25220 |
| Debian:13 | bind9 | 1:9.18.1-1 | DEBIAN-CVE-2021-25220 |
| Debian:14 | bind9 | 1:9.18.1-1 | DEBIAN-CVE-2021-25220 |
| Rocky Linux:8 | bind | 2:9.11.36-5.el8_7.2 | RLSA-2022:7790 |
| Rocky Linux:9 | bind | 2:9.16.23-5.el9_1 | RLSA-2022:8068 |
| Rocky Linux:8 | bind9.16 | 2:9.16.23-0.9.el8.1 | RLSA-2022:7643 |
| Rocky Linux:9 | dhcp | 2:4.4.2-17.b1.el9 | RLSA-2022:8385 |
| Ubuntu:22.04:LTS | bind9 | 1:9.18.0-2ubuntu3 | UBUNTU-CVE-2021-25220 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ISC | BIND | Open Source Branch 9.11 9.11.0 through versions before 9.11.37Development Branch 9.17 BIND 9.17 all versionOpen Source Branch 9.12-16 9.12.0 through versions before 9.16.27Open Source Branch 9.18 9.18.0Supported Preview Branch 9.11-S 9.11.0-S through versions before 9.11.37-SSupported Preview Branch 9.16-S 9.16.0-S through versions before 9.16.27-S |
References
- https://kb.isc.org/v1/docs/cve-2021-25220
- FEDORA-2022-14e36aac0c vendor-advisory
- FEDORA-2022-042d9c6146 vendor-advisory
- https://security.netapp.com/advisory/ntap-20220408-0001/
- FEDORA-2022-a88218de5c vendor-advisory
- FEDORA-2022-05918f0838 vendor-advisory
- FEDORA-2022-3f293290c3 vendor-advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
- GLSA-202210-25 vendor-advisory
- https://supportportal.juniper.net/s/article/2022-10-Security-Bulletin-Junos-OS-SRX-Series-Cache-poisoning-vulnerability-in-BIND-used-by-DNS-Proxy-CVE-2021-25220?language=en_US