Lucene search
Ubuntu.comUB:CVE-2024-1975HistoryJul 23, 2024 - 12:00 a.m.
CVE-2024-1975
2024-07-2300:00:00
ubuntu.com
ubuntu.com
2
cve-2024-1975
cpu exhaustion
isc-dhcp
bind9-libs
unix
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
7.6
Confidence
High
EPSS
0.001
Percentile
19.5%
If a server hosts a zone containing a “KEY” Resource Record, or a resolver
DNSSEC-validates a “KEY” Resource Record from a DNSSEC-signed domain in
cache, a client can exhaust resolver CPU resources by sending a stream of
SIG(0) signed requests.
This issue affects BIND 9 versions 9.0.0 through 9.11.37, 9.16.0 through
9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.9.3-S1 through
9.11.37-S1, 9.16.8-S1 through 9.16.49-S1, and 9.18.11-S1 through
9.18.27-S1.
Notes
| Author | Note |
|---|---|
| alexmurray | As of isc-dhcp-4.4.3-1, isc-dhcp vendors bind9 libs |
| mdeslaur | in focal and jammy, isc-dhcp uses the bind9-libs package This is unlikely to affect isc-dhcp’s use of bind9-libs and the vendored bind9 libs, marking as negligible |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 18.04 | noarch | bind9 | < any | UNKNOWN |
| ubuntu | 20.04 | noarch | bind9 | < 1:9.18.28-0ubuntu0.20.04.1 | UNKNOWN |
| ubuntu | 22.04 | noarch | bind9 | < 1:9.18.28-0ubuntu0.22.04.1 | UNKNOWN |
| ubuntu | 24.04 | noarch | bind9 | < 1:9.18.28-0ubuntu0.24.04.1 | UNKNOWN |
| ubuntu | 14.04 | noarch | bind9 | < any | UNKNOWN |
| ubuntu | 16.04 | noarch | bind9 | < any | UNKNOWN |
| ubuntu | 20.04 | noarch | bind9-libs | < any | UNKNOWN |
| ubuntu | 22.04 | noarch | bind9-libs | < any | UNKNOWN |
| ubuntu | 18.04 | noarch | isc-dhcp | < any | UNKNOWN |
| ubuntu | 24.04 | noarch | isc-dhcp | < any | UNKNOWN |
Related
nessus
nessus
F5 Networks BIG-IP : BIND vulnerability (K000140745)
2024-08-22 00:00:00
CBL Mariner 2.0 Security Update: bind / dhcp (CVE-2024-1975)
2024-08-19 00:00:00
SUSE SLES15 Security Update : bind (SUSE-SU-2024:2811-1)
2024-08-08 00:00:00
osv
osv
CVE-2024-1975
2024-07-23 15:15:03
Important: bind security update
2024-08-19 00:00:00
bind9 vulnerabilities
2024-08-15 19:09:34
openvas
openvas
ISC BIND DoS Vulnerability (CVE-2024-1975) - Windows
2024-07-24 00:00:00
ISC BIND DoS Vulnerability (CVE-2024-1975) - Linux
2024-07-24 00:00:00
Ubuntu: Security Advisory (USN-6909-3)
2024-08-16 00:00:00
debiancve
debiancve
CVE-2024-1975
2024-07-23 15:15:03
cloudlinux
cloudlinux
bind: Fix of CVE-2024-1975
2024-08-26 20:49:01
cbl_mariner
cbl_mariner
CVE-2024-1975 affecting package dhcp for versions less than 4.4.3.P1-2
2024-08-18 14:44:42
CVE-2024-1975 affecting package bind for versions less than 9.20.0-1
2024-08-02 00:50:42
CVE-2024-1975 affecting package bind for versions less than 9.16.50-1
2024-08-18 14:44:42
cvelist
cvelist
CVE-2024-1975 SIG(0) can be used to exhaust CPU resources
2024-07-23 14:38:57
nvd
nvd
CVE-2024-1975
2024-07-23 15:15:03
vulnrichment
vulnrichment
CVE-2024-1975 SIG(0) can be used to exhaust CPU resources
2024-07-23 14:38:57
wolfi
wolfi
CVE-2024-1975 vulnerabilities
2024-09-19 09:11:50
f5
f5
K000140745: BIND vulnerability CVE-2024-1975
2024-08-22 00:00:00
cve
cve
CVE-2024-1975
2024-07-23 15:15:03
alpinelinux
alpinelinux
CVE-2024-1975
2024-07-23 15:15:03
redhatcve
redhatcve
CVE-2024-1975
2024-07-23 21:24:24
veracode
veracode
Denial Of Service (DoS)
2024-07-24 07:16:10
amazon
amazon
Important: bind
2024-08-01 03:01:00
ubuntu
ubuntu
Bind vulnerabilities
2024-08-01 00:00:00
Bind vulnerabilities
2024-08-15 00:00:00
Bind vulnerabilities
2024-07-23 00:00:00
almalinux
almalinux
Important: bind security update
2024-08-19 00:00:00
Important: bind9.16 security update
2024-08-14 00:00:00
Important: bind and bind-dyndb-ldap security update
2024-08-15 00:00:00
redhat
redhat
(RHSA-2024:5908) Important: bind security update
2024-08-27 18:11:46
(RHSA-2024:5524) Important: bind security update
2024-08-19 00:59:37
(RHSA-2024:5655) Important: bind security update
2024-08-20 18:05:28
oraclelinux
oraclelinux
bind security update
2024-08-19 00:00:00
bind9.16 security update
2024-08-14 00:00:00
bind and bind-dyndb-ldap security update
2024-08-13 00:00:00
rocky
rocky
bind and bind-dyndb-ldap security update
2024-08-21 14:53:26
fedora
fedora
[SECURITY] Fedora 40 Update: bind-9.18.28-2.fc40
2024-08-03 01:50:41
[SECURITY] Fedora 39 Update: bind-9.18.28-2.fc39
2024-08-17 01:51:06
[SECURITY] Fedora 40 Update: bind-dyndb-ldap-11.10-29.fc40
2024-08-03 01:50:42
slackware
slackware
[slackware-security] bind
2024-07-23 19:08:45
ibm
ibm
redos
redos
ROS-20240807-10
2024-08-07 00:00:00
thn
thn
CISA Warns of Exploitable Vulnerabilities in Popular BIND 9 DNS Software
2024-07-25 05:30:00
photon
photon
Important Photon OS Security Update - PHSA-2024-4.0-0657
2024-07-24 00:00:00
Important Photon OS Security Update - PHSA-2024-3.0-0773
2024-07-24 00:00:00
Critical Photon OS Security Update - PHSA-2024-5.0-0330
2024-07-24 00:00:00
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
7.6
Confidence
High
EPSS
0.001
Percentile
19.5%
Related for UB:CVE-2024-1975