CVE-2020-8622

Published: Aug 21, 2020Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.

Affected (19)

Products: Isc: Bind · Fedoraproject: Fedora · Debian: Debian Linux · +5 more

Show all products

Isc: Bind · Fedoraproject: Fedora · Debian: Debian Linux · Canonical: Ubuntu Linux · Netapp: Steelstore Cloud Integrated Storage · Opensuse: Leap · Synology: Dns Server · Oracle: Communications Diameter Signaling Router

1 product

1 product

1 product

1 product

1 product

Steelstore Cloud Integrated Storage

1 product

1 product

1 product

Communications Diameter Signaling Router

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Isc Bind	From 9.0.0 to 9.11.21
Isc Bind	From 9.12.0 to 9.16.5
Isc Bind	From 9.17.0 to 9.17.3

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Isc Bind	Version 9.11.21 s1
Isc Bind	Version 9.9.3 s1

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 31
Fedoraproject Fedora	Version 32

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0

Configuration E

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 20.04

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Steelstore Cloud Integrated Storage	All versions

Configuration G

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1
Opensuse Leap	Version 15.2

Configuration H

1 vulnerable

Vulnerable Software	Affected Versions
Synology Dns Server	Before 2.2.2-5028

Configuration I

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Diameter Signaling Router	From 8.0.0 to 8.5.0

Related CWEs

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (26)

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html

Source: security-officer@isc.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html

Source: security-officer@isc.org

Mailing ListThird Party Advisory

https://kb.isc.org/docs/cve-2020-8622

Source: security-officer@isc.org

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2020/08/msg00053.html

Source: security-officer@isc.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQN62GBMCIC5AY4KYADGXNKVY6AJKSJE/

Source: security-officer@isc.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKAMJZXR66P6S5LEU4SN7USSNCWTXEXP/

Source: security-officer@isc.org

https://security.gentoo.org/glsa/202008-19

Source: security-officer@isc.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20200827-0003/

Source: security-officer@isc.org

Third Party Advisory

https://usn.ubuntu.com/4468-1/

Source: security-officer@isc.org

Third Party Advisory

https://usn.ubuntu.com/4468-2/

Source: security-officer@isc.org

Third Party Advisory

https://www.debian.org/security/2020/dsa-4752

Source: security-officer@isc.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: security-officer@isc.org

PatchThird Party Advisory

https://www.synology.com/security/advisory/Synology_SA_20_19

Source: security-officer@isc.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://kb.isc.org/docs/cve-2020-8622

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2020/08/msg00053.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQN62GBMCIC5AY4KYADGXNKVY6AJKSJE/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKAMJZXR66P6S5LEU4SN7USSNCWTXEXP/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/202008-19

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20200827-0003/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4468-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4468-2/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2020/dsa-4752

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.synology.com/security/advisory/Synology_SA_20_19

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.