A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal data structures are incorrectly reused under significant DNS-over-TLS query load.
This issue affects BIND 9 versions 9.18.0 through 9.18.18 and 9.18.11-S1 through 9.18.18-S1.
References
Link | Resource |
---|---|
http://www.openwall.com/lists/oss-security/2023/09/20/2 | Mailing List Third Party Advisory |
https://kb.isc.org/docs/cve-2023-4236 | Vendor Advisory |
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPJLLTJCSDJJII7IIZPLTBQNWP7MZH7F/ | Mailing List |
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U35OARLQCPMVCBBPHWBXY5M6XJLD2TZ5/ | Mailing List |
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSK5V4W4OHPM3JTJGWAQD6CZW7SFD75B/ | Mailing List Third Party Advisory |
https://security.netapp.com/advisory/ntap-20231013-0004/ | Third Party Advisory |
https://www.debian.org/security/2023/dsa-5504 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
AND |
|
Configuration 5 (hide)
AND |
|
Configuration 6 (hide)
AND |
|
Configuration 7 (hide)
AND |
|
Configuration 8 (hide)
AND |
|
History
01 Feb 2024, 00:53
Type | Values Removed | Values Added |
---|---|---|
First Time |
Debian
Netapp Netapp h300s Firmware Netapp h300s Netapp h500s Firmware Netapp h410c Netapp h700s Firmware Netapp h410s Firmware Debian debian Linux Netapp h500s Netapp h700s Netapp h410s Fedoraproject fedora Fedoraproject Netapp h410c Firmware |
|
References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U35OARLQCPMVCBBPHWBXY5M6XJLD2TZ5/ - Mailing List | |
References | (MISC) https://www.debian.org/security/2023/dsa-5504 - Third Party Advisory | |
References | (MISC) https://security.netapp.com/advisory/ntap-20231013-0004/ - Third Party Advisory | |
References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSK5V4W4OHPM3JTJGWAQD6CZW7SFD75B/ - Mailing List, Third Party Advisory | |
References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPJLLTJCSDJJII7IIZPLTBQNWP7MZH7F/ - Mailing List | |
CPE | cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* |
03 Nov 2023, 21:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
13 Oct 2023, 22:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
11 Oct 2023, 03:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
28 Sep 2023, 04:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
23 Sep 2023, 04:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
22 Sep 2023, 18:35
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:isc:bind:9.18.11:s1:*:*:supported_preview:*:*:* cpe:2.3:a:isc:bind:9.18.18:s1:*:*:supported_preview:*:*:* cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:* |
|
First Time |
Isc
Isc bind |
|
References | (MISC) https://kb.isc.org/docs/cve-2023-4236 - Vendor Advisory | |
References | (MISC) http://www.openwall.com/lists/oss-security/2023/09/20/2 - Mailing List, Third Party Advisory | |
CWE | CWE-617 |
20 Sep 2023, 15:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
20 Sep 2023, 13:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-09-20 13:15
Updated : 2024-02-28 20:33
NVD link : CVE-2023-4236
Mitre link : CVE-2023-4236
CVE.ORG link : CVE-2023-4236
JSON object : View
Products Affected
isc
- bind
netapp
- h300s
- h500s_firmware
- h700s_firmware
- h410c_firmware
- h700s
- h500s
- h410s_firmware
- h410s
- h410c
- h300s_firmware
fedoraproject
- fedora
debian
- debian_linux
CWE
CWE-617
Reachable Assertion