Alpine: bind: security update to 9.18.24-r0

high Tenable Self-Hosted Container Security Plugin ID 408287

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to
clean up the database. It uses several methods, including some that are asynchronous: a small chunk of
memory pointing to the cache element that can be cleaned up is first allocated and then queued for later
processing. It was discovered that if the resolver is continuously processing query patterns triggering
this type of cache-database maintenance, `named` may not be able to handle the cleanup events in a timely
manner. This in turn enables the list of queued cleanup events to grow infinitely large over time,
allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9
versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1. (CVE-2023-6516)

- The DNS message parsing code in `named` includes a section whose computational complexity is overly high.
It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive
CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative
servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through
9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1
through 9.18.21-S1. (CVE-2023-4408)

- A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: -
`nxdomain-redirect <domain>;` is configured, and - the resolver receives a PTR query for an RFC 1918
address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9
versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through
9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. (CVE-2023-5517)

- A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure
during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions
9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1,
and 9.18.11-S1 through 9.18.21-S1. (CVE-2023-5679)

- If a resolver cache has a very large number of ECS records stored for the same name, the process of
cleaning the cache database node for this name can significantly impair query performance. This issue
affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through
9.18.21-S1. (CVE-2023-5680)

Plugin Details

Severity: High

ID: 408287

Version: Revision 1.20

Type: Local

Family: Alpine Linux Local Security Checks

Published: 2/13/2024

Updated: 1/26/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Medium

Score: 5.7

Percentile: 96.49

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2023-6516

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 8/19/2021

Reference Information

CVE: CVE-2023-4408, CVE-2023-50387, CVE-2023-50868, CVE-2023-5517, CVE-2023-5679, CVE-2023-5680, CVE-2023-6516

IAVA: 2024-A-0103-S

Detections

Analytics