7.5

CVE-2023-5517

Querying RFC 1918 reverse zones may cause an assertion failure when "nxdomain-redirect" is enabled

A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when:

  - `nxdomain-redirect <domain>;` is configured, and
  - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response.
This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Netapp ≫ Active Iq Unified Manager Version - SwPlatform vmware_vsphere
Fedoraproject ≫ Fedora Version 38
Fedoraproject ≫ Fedora Version 39
Isc ≫ Bind SwEdition - Version >= 9.12.0 <= 9.16.45
Isc ≫ Bind SwEdition - Version >= 9.18.0 <= 9.18.21
Isc ≫ Bind SwEdition - Version >= 9.19.0 <= 9.19.19
Isc ≫ Bind Version 9.16.8 Update s1 SwEdition supported_preview
Isc ≫ Bind Version 9.16.11 Update s1 SwEdition supported_preview
Isc ≫ Bind Version 9.16.12 Update s1 SwEdition supported_preview
Isc ≫ Bind Version 9.16.13 Update s1 SwEdition supported_preview
Isc ≫ Bind Version 9.16.14 Update s1 SwEdition supported_preview
Isc ≫ Bind Version 9.16.21 Update s1 SwEdition supported_preview
Isc ≫ Bind Version 9.16.32 Update s1 SwEdition supported_preview
Isc ≫ Bind Version 9.16.36 Update s1 SwEdition supported_preview
Isc ≫ Bind Version 9.16.43 Update s1 SwEdition supported_preview
Isc ≫ Bind Version 9.16.45 Update s1 SwEdition supported_preview
Isc ≫ Bind Version 9.18.11 Update s1 SwEdition supported_preview
Isc ≫ Bind Version 9.18.18 Update s1 SwEdition supported_preview
Isc ≫ Bind Version 9.18.21 Update s1 SwEdition supported_preview
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.24% 0.661
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
ISC 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-617 Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

http://www.openwall.com/lists/oss-security/2024/02/13/1
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/
Third Party Advisory
Mailing List
https://kb.isc.org/docs/cve-2023-5517
Vendor Advisory
https://security.netapp.com/advisory/ntap-20240503-0006/
Third Party Advisory