Vulnerability in Isc Bind
CVE-2021-25219
In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.
EPSS: 0.106 (95.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Isc Bind — versions 9.9.3, 9.9.12, 9.9.13
- Isc Bind9 — versions Open Source Branches 9.3 through 9.11 9.3.0 through versions before 9.11.36, Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.22, Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.36-S1
- Netapp Cloud_backup
- Netapp H300e
- Netapp H300e_firmware
- Netapp H300s
- Netapp H300s_firmware
- Netapp H410c
- Netapp H410c_firmware
- Netapp H410s
Public proof-of-concept exploits
References
- security-officer@isc.org (Vendor Advisory)
- security-officer@isc.org (vendor-advisory, Third Party Advisory)
- security-officer@isc.org (mailing-list, Mailing List, Third Party Advisory)
- security-officer@isc.org (vendor-advisory)
- security-officer@isc.org (vendor-advisory)
- security-officer@isc.org (vendor-advisory)
- security-officer@isc.org (Third Party Advisory)
- security-officer@isc.org (Patch, Third Party Advisory)
- security-officer@isc.org (Third Party Advisory)
- security-officer@isc.org (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-25219?
- CVE-2021-25219 is a medium-severity vulnerability in Isc Bind. CVSS score: 5.3/10. Published 2021-10-27.
- How severe is CVE-2021-25219?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2021-25219 known to be exploited?
- 18 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.