7.5

CVE-2023-4408

The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers.
This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.

Data is provided by the National Vulnerability Database (NVD)
Netapp ≫ Ontap Version9.14.1
Netapp ≫ Ontap Version9.15.1
Fedoraproject ≫ Fedora Version38
Fedoraproject ≫ Fedora Version39
Isc ≫ Bind SwEdition- Version >= 9.0.0 <= 9.16.45
Isc ≫ Bind SwEdition- Version >= 9.18.0 <= 9.18.21
Isc ≫ Bind SwEdition- Version >= 9.19.0 <= 9.19.19
Isc ≫ Bind Version9.9.3 Updates1 SwEditionsupported_preview
Isc ≫ Bind Version9.16.8 Updates1 SwEditionsupported_preview
Isc ≫ Bind Version9.16.11 Updates1 SwEditionsupported_preview
Isc ≫ Bind Version9.16.12 Updates1 SwEditionsupported_preview
Isc ≫ Bind Version9.16.13 Updates1 SwEditionsupported_preview
Isc ≫ Bind Version9.16.14 Updates1 SwEditionsupported_preview
Isc ≫ Bind Version9.16.21 Updates1 SwEditionsupported_preview
Isc ≫ Bind Version9.16.32 Updates1 SwEditionsupported_preview
Isc ≫ Bind Version9.16.36 Updates1 SwEditionsupported_preview
Isc ≫ Bind Version9.16.43 Updates1 SwEditionsupported_preview
Isc ≫ Bind Version9.18.0 Updates1 SwEditionsupported_preview
Isc ≫ Bind Version9.18.11 Updates1 SwEditionsupported_preview
Isc ≫ Bind Version9.18.18 Updates1 SwEditionsupported_preview
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.3% 0.524
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
security-officer@isc.org 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-407 Inefficient Algorithmic Complexity

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.