Reachable Assertion Affecting bind9.16-devel package, versions <32:9.16.23-0.14.el8_8.4


Severity

Recommended
0.0
high
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.09% (40th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-BIND916DEVEL-6526915
  • published3 Apr 2024
  • disclosed13 Feb 2024

Introduced: 13 Feb 2024

CVE-2023-5679  (opens in a new tab)
CWE-617  (opens in a new tab)

How to fix?

Upgrade RHEL:8 bind9.16-devel to version 32:9.16.23-0.14.el8_8.4 or higher.
This issue was patched in RHSA-2024:1648.

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind9.16-devel package and not the bind9.16-devel package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

A bad interaction between DNS64 and serve-stale may cause named to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.

CVSS Scores

version 3.1