CVE-2021-25220

CVE Details

Release Date:

2022-03-23

Description

BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.

See more information about CVE-2021-25220 from MITRE CVE dictionary and NIST NVD

CVSS v3.0 metrics

NOTE: The following CVSS v3.0 metrics and score provided are preliminary and subject to review.

Base Score:	6.8	Base Metrics:	AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Access Vector:	Network	Attack Complexity:	Low
Privileges Required:	High	User Interaction:	None
Scope:	Changed	Confidentiality Impact:	None
Integrity Impact:	High	Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 7 (bind)	ELSA-2023-0402	2023-01-24
Oracle Linux version 8 (bind)	ELSA-2022-7790	2022-11-15
Oracle Linux version 8 (bind9.16)	ELSA-2022-7643	2022-11-15
Oracle Linux version 9 (bind)	ELSA-2022-8068	2022-11-22
Oracle Linux version 9 (dhcp)	ELSA-2022-8385	2022-11-22

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team