Log in Start free

Vulnerability · Published Aug 18, 2021 · Assigned by isc

CVE-2021-25218A too-strict assertion check could be triggered when responses in BIND 9.16.19 and 9.17.16 require UDP fragmentation if RRL is in use

High 7.5

In plain English

A high-severity security flaw in BIND9 from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.7% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)3.7%top 10.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In BIND 9.16.19, 9.17.16. Also, version 9.16.19-S1 of BIND Supported Preview Edition When a vulnerable version of named receives a query under the circumstances described above, the named process will terminate due to a failed assertion check. The vulnerability affects only BIND 9 releases 9.16.19, 9.17.16, and release 9.16.19-S1 of the BIND Supported Preview Edition.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20bind9.16.20-r0ALPINE-CVE-2021-25218
Alpine:v3.21bind9.16.20-r0ALPINE-CVE-2021-25218
Alpine:v3.22bind9.16.20-r0ALPINE-CVE-2021-25218
Alpine:v3.23bind9.16.20-r0ALPINE-CVE-2021-25218
Alpine:v3.24bind9.16.20-r0ALPINE-CVE-2021-25218

Affected products (as reported)

VendorProductVersions
ISC BIND9 Stable Branch 9.16.19Development Branch 9.17.16Supported Preview Edition 9.16.19-S1

References