REDHAT-BUG-2342880: High severity ISC BIND vulnerability
Description: Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.
Impact: By flooding a target resolver with HTTP/2 traffic and exploiting this flaw, an attacker could overwhelm the server, causing high CPU and/or memory usage and preventing other clients from establishing DoH connections. This would significantly impair the resolver's performance and effectively deny legitimate clients access to the DNS resolution service.
Authoritative servers are affected by this vulnerability. Resolvers are affected by this vulnerability.
Versions affected: 9.18.0 -> 9.18.32 9.20.0 -> 9.20.4 9.21.0 -> 9.21.3
(Versions prior to 9.18.27 were not assessed.)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.18.27 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.20.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.21.3
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2342880?
The severity of REDHAT-BUG-2342880 is critical due to its potential to exhaust the CPU and memory of a DNS resolver.
How do I fix REDHAT-BUG-2342880?
To fix REDHAT-BUG-2342880, update your ISC BIND to a version that addresses this vulnerability.
What software is affected by REDHAT-BUG-2342880?
Affected software includes ISC BIND versions from 9.18.0 to 9.18.32, 9.20.0 to 9.20.4, and 9.21.0 to 9.21.3.
What kind of attack does REDHAT-BUG-2342880 facilitate?
REDHAT-BUG-2342880 facilitates a denial of service attack by flooding a DNS resolver with crafted HTTP/2 traffic.
Who discovered REDHAT-BUG-2342880?
The specific discoverer of REDHAT-BUG-2342880 is not mentioned, but it has been reported in the Red Hat bug tracking system.