SUSE-SU-2023:2793-1

HIGH7.5

Security update for bind

Published Jul 7, 2023

Modified 2 years ago

Fix available

Details

Description of the patch:

This update for bind fixes the following issues:

CVE-2023-2828: Fixed denial-of-service against recursive resolvers related to cache-cleaning algorithm (bsc#1212544).

Affected Packages(14 packages)

bind

SUSE Linux Enterprise Server 12 SP4-ESPOSSUSE Linux Enterprise Server 12 SP4-LTSSSUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP4SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

9.11.22-3.46.4

bind-chrootenv

Fixed in:

9.11.22-3.46.4

bind-doc

Fixed in:

9.11.22-3.46.4

bind-utils

Fixed in:

9.11.22-3.46.4

libbind9-161

Fixed in:

9.11.22-3.46.4

libdns1110

Fixed in:

9.11.22-3.46.4

libirs161

Fixed in:

9.11.22-3.46.4

libisc1107

Fixed in:

9.11.22-3.46.4

libisc1107-32bit

Fixed in:

9.11.22-3.46.4

libisccc161

Fixed in:

9.11.22-3.46.4

References

ADVISORY

https://bugzilla.suse.com/1212544

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2023-July/015459.html

ADVISORY

https://www.suse.com/security/cve/CVE-2023-2828/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2023/suse-su-20232793-1/

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Upstream

CVE-2023-2828

Ecosystems(8)

SUSE Linux Enterprise Server 12 SP4-ESPOS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5

Timeline

PublishedJul 7, 2023

ModifiedJul 7, 2023

SUSE-SU-2023:2793-1 | Mondoo Vulnerability Intelligence