Vulnerability in Isc Bind
CVE-2021-25219
In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.106 (95.7th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 95.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.106 · newest: 0.106 · change: 0.000
Affected products
- Isc Bind — versions 9.9.3, 9.9.12, 9.9.13
- Isc Bind9 — versions Open Source Branches 9.3 through 9.11 9.3.0 through versions before 9.11.36, Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.22, Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.36-S1
- NetApp Cloud Backup
- NetApp H300e
- NetApp H300e Firmware
- NetApp H300s
- NetApp H300s Firmware
- NetApp H410c
- NetApp H410c Firmware
- NetApp H410s
Public proof-of-concept exploits
References
- kb.isc.org/v1/docs/cve-2021-25219 (Vendor Advisory)
- www.debian.org/security/2021/dsa-4994 (vendor-advisory, Third Party Advisory)
- lists.debian.org/debian-lts-announce/2021/11/msg00001.html (mailing-list, Mailing List, Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- www.oracle.com/security-alerts/cpuapr2022.html (Third Party Advisory)
- cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf (Patch, Third Party Advisory)
- security.netapp.com/advisory/ntap-20211118-0002/ (Third Party Advisory)
- security.gentoo.org/glsa/202210-25 (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-25219?
- CVE-2021-25219 is a medium-severity vulnerability in Isc Bind. CVSS score: 5.3/10. Published 2021-10-27.
- How severe is CVE-2021-25219?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2021-25219 known to be exploited?
- 18 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.