Vulnerability · Published May 19, 2022 · Assigned by isc
CVE-2022-1183Destroying a TLS session early causes assertion failure
High 7.5
In plain English
A high-severity security flaw in BIND9 from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.2% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that include a reference to http within the listen-on statements in their named.conf. TLS is used by both DNS over TLS (DoT) and DNS over HTTPS (DoH), but configurations using DoT alone are unaffected. Affects BIND 9.18.0 -> 9.18.2 and version 9.19.0 of the BIND 9.19 development branch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | bind9 | 1:9.18.3-1 | DEBIAN-CVE-2022-1183 |
| Debian:13 | bind9 | 1:9.18.3-1 | DEBIAN-CVE-2022-1183 |
| Debian:14 | bind9 | 1:9.18.3-1 | DEBIAN-CVE-2022-1183 |
| Ubuntu:22.04:LTS | bind9 | 1:9.18.1-1ubuntu1.1 | USN-5429-1 |
| Ubuntu:22.04:LTS | bind9 | 1:9.18.1-1ubuntu1.1 | UBUNTU-CVE-2022-1183 |
Affected products (as reported)
References
- https://kb.isc.org/docs/cve-2022-1183 x_refsource_CONFIRM
- https://security.netapp.com/advisory/ntap-20220707-0002/ x_refsource_CONFIRM