CVE-2020-8620high

CVE-2020-8620: fallo de gravedad alta en ISC BIND9

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear BIND9+ Monitorear bind9

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 3.9%
In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to trigger the assertion failure, causing the server to exit.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
ISC · BIND9
CVEs relacionadas — ISC BIND9

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-8617HIGHA logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.cEPSS 93.3%CVE-2021-25216HIGHA second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attackEPSS 83.0%CVE-2020-8625HIGHA vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attackEPSS 64.2%CVE-2021-25215HIGHAn assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itselfEPSS 11.7%CVE-2021-25219MEDIUMLame cache can be abused to severely degrade resolver performanceEPSS 11.2%CVE-2020-8616HIGHBIND does not sufficiently limit the number of fetches performed when processing referralsEPSS 10.9%