OESA-2025-2609

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-2609
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2025-2609.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2025-2609
Upstream
Published
2025-10-31T14:13:54Z
Modified
2025-10-31T21:05:10.393674Z
Summary
bind security update
Details

Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server.

Security Fix(es):

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.(CVE-2023-50387)

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.(CVE-2023-50868)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:20.03-LTS-SP4 / bind

Package

Name
bind
Purl
pkg:rpm/openEuler/bind&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.11.21-21.oe2003sp4

Ecosystem specific 

{
    "noarch": [
        "python3-bind-9.11.21-21.oe2003sp4.noarch.rpm"
    ],
    "aarch64": [
        "bind-9.11.21-21.oe2003sp4.aarch64.rpm",
        "bind-chroot-9.11.21-21.oe2003sp4.aarch64.rpm",
        "bind-debuginfo-9.11.21-21.oe2003sp4.aarch64.rpm",
        "bind-debugsource-9.11.21-21.oe2003sp4.aarch64.rpm",
        "bind-devel-9.11.21-21.oe2003sp4.aarch64.rpm",
        "bind-export-devel-9.11.21-21.oe2003sp4.aarch64.rpm",
        "bind-export-libs-9.11.21-21.oe2003sp4.aarch64.rpm",
        "bind-libs-9.11.21-21.oe2003sp4.aarch64.rpm",
        "bind-libs-lite-9.11.21-21.oe2003sp4.aarch64.rpm",
        "bind-pkcs11-9.11.21-21.oe2003sp4.aarch64.rpm",
        "bind-pkcs11-devel-9.11.21-21.oe2003sp4.aarch64.rpm",
        "bind-utils-9.11.21-21.oe2003sp4.aarch64.rpm"
    ],
    "x86_64": [
        "bind-9.11.21-21.oe2003sp4.x86_64.rpm",
        "bind-chroot-9.11.21-21.oe2003sp4.x86_64.rpm",
        "bind-debuginfo-9.11.21-21.oe2003sp4.x86_64.rpm",
        "bind-debugsource-9.11.21-21.oe2003sp4.x86_64.rpm",
        "bind-devel-9.11.21-21.oe2003sp4.x86_64.rpm",
        "bind-export-devel-9.11.21-21.oe2003sp4.x86_64.rpm",
        "bind-export-libs-9.11.21-21.oe2003sp4.x86_64.rpm",
        "bind-libs-9.11.21-21.oe2003sp4.x86_64.rpm",
        "bind-libs-lite-9.11.21-21.oe2003sp4.x86_64.rpm",
        "bind-pkcs11-9.11.21-21.oe2003sp4.x86_64.rpm",
        "bind-pkcs11-devel-9.11.21-21.oe2003sp4.x86_64.rpm",
        "bind-utils-9.11.21-21.oe2003sp4.x86_64.rpm"
    ],
    "src": [
        "bind-9.11.21-21.oe2003sp4.src.rpm"
    ]
}