—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2023.3980
Security update for bind
17 July 2023
===========================================================================
AusCERT Security Bulletin Summary
———————————
Product: bind
Publisher: SUSE
Operating System: SUSE
Resolution: Patch/Upgrade
CVE Names: CVE-2023-2911 CVE-2023-2828
Original Bulletin:
https://www.suse.com/support/update/announcement/2023/suse-su-20232836-1
Comment: CVSS (Max): 7.5 CVE-2023-2911 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS Source: SUSE
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
– ————————–BEGIN INCLUDED TEXT——————–
Security update for bind
Announcement ID: SUSE-SU-2023:2836-1
Rating: important
o #1212090
References: o #1212544
o #1212567
o CVE-2023-2828
Cross-References: o CVE-2023-2911
o CVE-2023-2828 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/
S:U/C:N/I:N/A:H
o CVE-2023-2828 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/
S:U/C:N/I:N/A:H
CVSS scores: o CVE-2023-2911 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/
S:U/C:N/I:N/A:H
o CVE-2023-2911 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/
S:U/C:N/I:N/A:H
o Basesystem Module 15-SP5
o openSUSE Leap 15.5
o Server Applications Module 15-SP5
Affected o SUSE Linux Enterprise Desktop 15 SP5
Products: o SUSE Linux Enterprise High Performance Computing 15 SP5
o SUSE Linux Enterprise Real Time 15 SP5
o SUSE Linux Enterprise Server 15 SP5
o SUSE Linux Enterprise Server for SAP Applications 15 SP5
An update that solves two vulnerabilities, contains one feature and has one fix
can now be installed.
Description:
This update for bind fixes the following issues:
Update to release 9.16.42
Security Fixes:
o The overmem cleaning process has been improved, to prevent the cache from
significantly exceeding the configured max-cache-size limit.
(CVE-2023-2828)
o A query that prioritizes stale data over lookup triggers a fetch to refresh
the stale data in cache. If the fetch is aborted for exceeding the
recursion quota, it was possible for named to enter an infinite callback
loop and crash due to stack overflow. This has been fixed. (CVE-2023-2911)
Bug Fixes:
o Previously, it was possible for a delegation from cache to be returned to
the client after the stale-answer-client-timeout duration. This has been
fixed. [bsc#1212544, bsc#1212567, jsc#SLE-24600]
Update to release 9.16.41
Bug Fixes:
o When removing delegations from an opt-out range, empty-non-terminal NSEC3
records generated by those delegations were not cleaned up. This has been
fixed. [jsc#SLE-24600]
Update to release 9.16.40
Bug Fixes:
o Logfiles using timestamp-style suffixes were not always correctly removed
when the number of files exceeded the limit set by versions. This has been
fixed for configurations which do not explicitly specify a directory path
as part of the file argument in the channel specification.
o Performance of DNSSEC validation in zones with many DNSKEY records has been
improved.
Update to release 9.16.39
Feature Changes:
o libuv support for receiving multiple UDP messages in a single recvmmsg()
system call has been tweaked several times between libuv versions 1.35.0
and 1.40.0; the current recommended libuv version is 1.40.0 or higher. New
rules are now in effect for running with a different version of libuv than
the one used at compilation time. These rules may trigger a fatal error at
startup:
o Building against or running with libuv versions 1.35.0 and 1.36.0 is now a
fatal error.
o Running with libuv version higher than 1.34.2 is now a fatal error when
named is built against libuv version 1.34.2 or lower.
o Running with libuv version higher than 1.39.0 is now a fatal error when
named is built against libuv version 1.37.0, 1.38.0, 1.38.1, or 1.39.0.
o This prevents the use of libuv versions that may trigger an assertion
failure when receiving multiple UDP messages in a single system call.
Bug Fixes:
o named could crash with an assertion failure when adding a new zone into the
configuration file for a name which was already configured as a member zone
for a catalog zone. This has been fixed.
o When named starts up, it sends a query for the DNSSEC key for each
configured trust anchor to determine whether the key has changed. In some
unusual cases, the query might depend on a zone for which the server is
itself authoritative, and would have failed if it were sent before the zone
was fully loaded. This has now been fixed by delaying the key queries until
all zones have finished loading. [jsc#SLE-24600]
Patch Instructions:
To install this SUSE Important update use the SUSE recommended installation
methods like YaST online_update or “zypper patch”.
Alternatively you can run the command listed for your product:
o openSUSE Leap 15.5
zypper in -t patch SUSE-2023-2836=1 openSUSE-SLE-15.5-2023-2836=1
o Basesystem Module 15-SP5
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-2836=1
o Server Applications Module 15-SP5
zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2023-2836=1
Package List:
o openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586)
bind-9.16.42-150500.8.3.1
bind-debuginfo-9.16.42-150500.8.3.1
bind-utils-debuginfo-9.16.42-150500.8.3.1
bind-debugsource-9.16.42-150500.8.3.1
bind-utils-9.16.42-150500.8.3.1
o openSUSE Leap 15.5 (noarch)
python3-bind-9.16.42-150500.8.3.1
bind-doc-9.16.42-150500.8.3.1
o Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64)
bind-utils-debuginfo-9.16.42-150500.8.3.1
bind-debugsource-9.16.42-150500.8.3.1
bind-utils-9.16.42-150500.8.3.1
bind-debuginfo-9.16.42-150500.8.3.1
o Basesystem Module 15-SP5 (noarch)
python3-bind-9.16.42-150500.8.3.1
o Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64)
bind-9.16.42-150500.8.3.1
bind-debugsource-9.16.42-150500.8.3.1
bind-debuginfo-9.16.42-150500.8.3.1
o Server Applications Module 15-SP5 (noarch)
bind-doc-9.16.42-150500.8.3.1
References:
o https://www.suse.com/security/cve/CVE-2023-2828.html
o https://www.suse.com/security/cve/CVE-2023-2911.html
o https://bugzilla.suse.com/show_bug.cgiid=1212090
o https://bugzilla.suse.com/show_bug.cgiid=1212544
o https://bugzilla.suse.com/show_bug.cgiid=1212567
o https://jira.suse.com/browse/SLE-24600
– ————————–END INCLUDED TEXT——————–
You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to [email protected]
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: [email protected]
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZLSWQskNZI30y1K9AQhhYRAAidy+VxV48hyHw4znoGYXO110bOr2nExN
W49ClzRwoDzW2eR4MOiu0vjvPc8vPNloh8N5EAgA79FOTN+IQ5iI9HQWX/rwHN6V
oNPUqLaFsHP3IAIC5G/Biltwr3JNX4L5ojQC/hrd7S7Y/G7APGebuS8sZcoeSu8z
zD4sN1nBqGmSTjMjTj9E8XHJwE8VWM+Pt/gI7aMwJYZs3zoBBw2doXEVVbnMSQBx
h7tQEwL5hu7l/6cQ4/xePWLwlgWlxpc+TCxymJ7I7bJM1iPm3gTQ80wT/yw6XUfr
rrhJkQ9g/ZTnkSE5Qzpyb1MtW/Axbl2gDdswhZ6cQm7BAECpNyAuZRCSYUdmiQJ3
16CnpkgZRHAZ4Izu+CHZtVejovlmT/Auzt7V+KZm2Zh5TSxysGZ/36HmzyS5cYz1
uNLojm3X1buib8n3S4LHH9GkpyMr6g2DXP2GIR/wKKREmO3zmxAP/mbPWb7voT3y
WKMlzuUZgBiSKou7nnCp3o2ubfIAwniNgN0ZjC7m5MqNQo3lF95LOpgdtH9jbJhj
9WQ93EkpxmPdlnt4sktW+ENKigeGeMa1HZezmgy/JYqs1O05D4/w1cldr7AfKo6u
SRJsvcDMLtfs9BIUWEKyYl75J5BrBWXMgK/no8u6avcKDxurVSobvvCIkR9QeBph
QE1MsT8ktVI=
=TfF7
—–END PGP SIGNATURE—–
Source: Read More
Security Bulletins