Log in Start free

Vulnerability · Published Aug 21, 2020 · Assigned by isc

CVE-2020-8623A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c

High 7.5

In plain English

A high-severity security flaw in BIND9 from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.6% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)6.6%top 6.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with "--enable-native-pkcs11" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20bind9.16.6-r0ALPINE-CVE-2020-8623
Alpine:v3.21bind9.16.6-r0ALPINE-CVE-2020-8623
Alpine:v3.22bind9.16.6-r0ALPINE-CVE-2020-8623
Alpine:v3.23bind9.16.6-r0ALPINE-CVE-2020-8623
Alpine:v3.24bind9.16.6-r0ALPINE-CVE-2020-8623
Debian:12bind91:9.16.6-1DEBIAN-CVE-2020-8623
Debian:13bind91:9.16.6-1DEBIAN-CVE-2020-8623
Debian:14bind91:9.16.6-1DEBIAN-CVE-2020-8623

Affected products (as reported)

VendorProductVersions
ISC BIND9 9.10.0 – before unspecifiedunspecified – before 9.11.229.12.0 – before unspecifiedunspecified – before 9.16.69.17.0 – before unspecifiedunspecified – before 9.17.49.10.5-S1 – before Supported Preview*

References