Detections
Analytics

Alpine: multiple bind packages: security update to 9.14.12-r0

high Tenable Cloud Security Plugin ID 423701

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches
 performed when processing referrals can, through the use of specially crafted referrals, cause a recursing
 server to issue a very large number of fetches in an attempt to process the referral. This has at least
 two potential effects: The performance of the recursing server can potentially be degraded by the
 additional work required to perform these fetches, and The attacker can exploit this behavior to use the
 recursing server as a reflector in a reflection attack with a high amplification factor. (CVE-2020-8616)

 - Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an
 inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the
 server. Since BIND, by default, configures a local session key even on servers whose configuration does
 not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating
 from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately
 exits. Prior to the introduction of the check the server would continue operating in an inconsistent
 state, with potentially harmful results. (CVE-2020-8617)

See Also

https://security.alpinelinux.org/vuln/CVE-2020-8616

https://security.alpinelinux.org/vuln/CVE-2020-8617

Plugin Details

Severity: High

ID: 423701

Version: Revision 1.8

Type: Local

Published: 4/4/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 95.09

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2020-8616

CVSS v3

Risk Factor: High

Base Score: 8.6

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 5/19/2020

Reference Information

CVE: CVE-2020-8616, CVE-2020-8617

IAVA: 2020-A-0217-S