Vulnerability · Published Sep 21, 2022 · Assigned by isc
CVE-2022-2795Processing large delegations may severely degrade resolver performance
Medium 5.3
In plain English
A medium-severity security flaw in BIND9 from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)2.3%top 16.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | bind | 32:9.11.36-8.el8 | ALSA-2023:3002 |
| AlmaLinux:9 | bind | 32:9.16.23-11.el9 | ALSA-2023:2261 |
| AlmaLinux:8 | bind-chroot | 32:9.11.36-8.el8 | ALSA-2023:3002 |
| AlmaLinux:9 | bind-chroot | 32:9.16.23-11.el9 | ALSA-2023:2261 |
| AlmaLinux:8 | bind-devel | 32:9.11.36-8.el8 | ALSA-2023:3002 |
| AlmaLinux:9 | bind-devel | 32:9.16.23-11.el9 | ALSA-2023:2261 |
| AlmaLinux:9 | bind-dnssec-doc | 32:9.16.23-11.el9 | ALSA-2023:2261 |
| AlmaLinux:9 | bind-dnssec-utils | 32:9.16.23-11.el9 | ALSA-2023:2261 |
| AlmaLinux:9 | bind-doc | 32:9.16.23-11.el9 | ALSA-2023:2261 |
| AlmaLinux:8 | bind-export-devel | 32:9.11.36-8.el8 | ALSA-2023:3002 |
| AlmaLinux:8 | bind-export-libs | 32:9.11.36-8.el8 | ALSA-2023:3002 |
| AlmaLinux:8 | bind-libs | 32:9.11.36-8.el8 | ALSA-2023:3002 |
| AlmaLinux:9 | bind-libs | 32:9.16.23-11.el9 | ALSA-2023:2261 |
| AlmaLinux:8 | bind-libs-lite | 32:9.11.36-8.el8 | ALSA-2023:3002 |
| AlmaLinux:8 | bind-license | 32:9.11.36-8.el8 | ALSA-2023:3002 |
| AlmaLinux:9 | bind-license | 32:9.16.23-11.el9 | ALSA-2023:2261 |
| AlmaLinux:8 | bind-lite-devel | 32:9.11.36-8.el8 | ALSA-2023:3002 |
| AlmaLinux:8 | bind-pkcs11 | 32:9.11.36-8.el8 | ALSA-2023:3002 |
| AlmaLinux:8 | bind-pkcs11-devel | 32:9.11.36-8.el8 | ALSA-2023:3002 |
| AlmaLinux:8 | bind-pkcs11-libs | 32:9.11.36-8.el8 | ALSA-2023:3002 |
| AlmaLinux:8 | bind-pkcs11-utils | 32:9.11.36-8.el8 | ALSA-2023:3002 |
| AlmaLinux:8 | bind-sdb | 32:9.11.36-8.el8 | ALSA-2023:3002 |
| AlmaLinux:8 | bind-sdb-chroot | 32:9.11.36-8.el8 | ALSA-2023:3002 |
| AlmaLinux:8 | bind-utils | 32:9.11.36-8.el8 | ALSA-2023:3002 |
| AlmaLinux:9 | bind-utils | 32:9.16.23-11.el9 | ALSA-2023:2261 |
| AlmaLinux:8 | bind9.16 | 32:9.16.23-0.14.el8 | ALSA-2023:2792 |
| AlmaLinux:8 | bind9.16-chroot | 32:9.16.23-0.14.el8 | ALSA-2023:2792 |
| AlmaLinux:8 | bind9.16-devel | 32:9.16.23-0.14.el8 | ALSA-2023:2792 |
| AlmaLinux:8 | bind9.16-dnssec-utils | 32:9.16.23-0.14.el8 | ALSA-2023:2792 |
| AlmaLinux:8 | bind9.16-doc | 32:9.16.23-0.14.el8 | ALSA-2023:2792 |
| AlmaLinux:8 | bind9.16-libs | 32:9.16.23-0.14.el8 | ALSA-2023:2792 |
| AlmaLinux:8 | bind9.16-license | 32:9.16.23-0.14.el8 | ALSA-2023:2792 |
| AlmaLinux:8 | bind9.16-utils | 32:9.16.23-0.14.el8 | ALSA-2023:2792 |
| AlmaLinux:8 | python3-bind | 32:9.11.36-8.el8 | ALSA-2023:3002 |
| AlmaLinux:9 | python3-bind | 32:9.16.23-11.el9 | ALSA-2023:2261 |
| AlmaLinux:8 | python3-bind9.16 | 32:9.16.23-0.14.el8 | ALSA-2023:2792 |
| Alpine:v3.20 | bind | 9.18.7-r0 | ALPINE-CVE-2022-2795 |
| Alpine:v3.21 | bind | 9.18.7-r0 | ALPINE-CVE-2022-2795 |
| Alpine:v3.22 | bind | 9.18.7-r0 | ALPINE-CVE-2022-2795 |
| Alpine:v3.23 | bind | 9.18.7-r0 | ALPINE-CVE-2022-2795 |
| Alpine:v3.24 | bind | 9.18.7-r0 | ALPINE-CVE-2022-2795 |
| Debian:12 | bind9 | 1:9.18.7-1 | DEBIAN-CVE-2022-2795 |
| Debian:13 | bind9 | 1:9.18.7-1 | DEBIAN-CVE-2022-2795 |
| Debian:14 | bind9 | 1:9.18.7-1 | DEBIAN-CVE-2022-2795 |
| Ubuntu:22.04:LTS | bind9 | 1:9.18.1-1ubuntu1.2 | USN-5626-1 |
| Ubuntu:22.04:LTS | bind9 | 1:9.18.1-1ubuntu1.2 | UBUNTU-CVE-2022-2795 |
| Ubuntu:22.04:LTS | bind9-libs | no fix listed | UBUNTU-CVE-2022-2795 |
| Ubuntu:24.04:LTS | isc-dhcp | no fix listed | UBUNTU-CVE-2022-2795 |
| Ubuntu:25.10 | isc-dhcp | no fix listed | UBUNTU-CVE-2022-2795 |
| Ubuntu:26.04:LTS | isc-dhcp | no fix listed | UBUNTU-CVE-2022-2795 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ISC | BIND9 | Open Source Branches 9.0 through 9.16 9.0.0 through versions before 9.16.33Open Source Branch 9.18 9.18.0 through versions before 9.18.7Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions up to and including 9.11.37-S1Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1Development Branch 9.19 9.19.0 through versions before 9.19.5 |
References
- https://kb.isc.org/docs/cve-2022-2795
- [oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178) mailing-list
- DSA-5235 vendor-advisory
- FEDORA-2022-ef038365de vendor-advisory
- FEDORA-2022-8268735e06 vendor-advisory
- FEDORA-2022-b197d64471 vendor-advisory
- [debian-lts-announce] 20221005 [SECURITY] [DLA 3138-1] bind9 security update mailing-list
- GLSA-202210-25 vendor-advisory
- https://security.netapp.com/advisory/ntap-20241129-0002/