Oracle Linux: CVE-2024-1737: ELSA-2024-5390: bind9.16 security update (IMPORTANT) (Multiple Advisories)

Oracle Linux: CVE-2024-1737: ELSA-2024-5390:bind9.16 security update (IMPORTANT) (Multiple Advisories)

Severity

8

CVSS

(AV:N/AC:L/Au:N/C:N/I:N/A:C)

Published

07/23/2024

Created

10/18/2024

Added

10/16/2024

Modified

01/07/2025

Description

Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name. This issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1. A flaw was found in the bind9 package, where a hostname with significant resource records may slow down bind's resolver cache and authoritative zone databases while these records are being added or updated. In addition, client queries for the related hostname may cause the same issue. This vulnerability may lead to a denial of service.

Solution(s)

• oracle-linux-upgrade-bind
• oracle-linux-upgrade-bind9-16
• oracle-linux-upgrade-bind9-16-chroot
• oracle-linux-upgrade-bind9-16-devel
• oracle-linux-upgrade-bind9-16-dnssec-utils
• oracle-linux-upgrade-bind9-16-doc
• oracle-linux-upgrade-bind9-16-libs
• oracle-linux-upgrade-bind9-16-license
• oracle-linux-upgrade-bind9-16-utils
• oracle-linux-upgrade-bind-chroot
• oracle-linux-upgrade-bind-devel
• oracle-linux-upgrade-bind-dnssec-doc
• oracle-linux-upgrade-bind-dnssec-utils
• oracle-linux-upgrade-bind-doc
• oracle-linux-upgrade-bind-dyndb-ldap
• oracle-linux-upgrade-bind-export-devel
• oracle-linux-upgrade-bind-export-libs
• oracle-linux-upgrade-bind-libs
• oracle-linux-upgrade-bind-libs-lite
• oracle-linux-upgrade-bind-license
• oracle-linux-upgrade-bind-lite-devel
• oracle-linux-upgrade-bind-pkcs11
• oracle-linux-upgrade-bind-pkcs11-devel
• oracle-linux-upgrade-bind-pkcs11-libs
• oracle-linux-upgrade-bind-pkcs11-utils
• oracle-linux-upgrade-bind-sdb
• oracle-linux-upgrade-bind-sdb-chroot
• oracle-linux-upgrade-bind-utils
• oracle-linux-upgrade-python3-bind
• oracle-linux-upgrade-python3-bind9-16

References

• https://attackerkb.com/topics/cve-2024-1737
• CVE - 2024-1737
• ELSA-2024-5390
• ELSA-2024-5524
• ELSA-2024-5930
• ELSA-2024-5231