CVE-2021-25220

CVE Details

Release Date:	2022-03-23
Impact:	None	What is this?

Description

BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.

See more information about CVE-2021-25220 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	6.8
Vector String:	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Version:	3.0
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	High
User Interaction:	None
Scope:	Changed
Confidentiality Impact:	None
Integrity Impact:	High
Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 7 (bind)	ELSA-2023-0402	2023-01-24
Oracle Linux version 8 (bind)	ELSA-2022-7790	2022-11-15
Oracle Linux version 8 (bind9.16)	ELSA-2022-7643	2022-11-15
Oracle Linux version 9 (bind)	ELSA-2022-8068	2022-11-22
Oracle Linux version 9 (dhcp)	ELSA-2022-8385	2022-11-22