DEBIAN-CVE-2022-3924

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2022-3924
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-3924.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2022-3924
Upstream
Published
2023-01-26T21:16:03Z
Modified
2025-09-19T07:32:55.161721Z
Summary
[none]
Details

This issue can affect BIND 9 resolvers with stale-answer-enable yes; that also make use of the option stale-answer-client-timeout, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM recursive-clients limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1.

References

Affected packages

Debian:11 / bind9

Package

Name
bind9
Purl
pkg:deb/debian/bind9?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:9.16.37-1~deb11u1

Affected versions

1:9.*

1:9.16.15-1
1:9.16.21-1
1:9.16.21-1+hurd.1
1:9.16.22-1~deb11u1~bpo10+1
1:9.16.22-1~deb11u1
1:9.16.27-1~deb11u1~bpo10+1
1:9.16.27-1~deb11u1
1:9.16.33-1~deb11u1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / bind9

Package

Name
bind9
Purl
pkg:deb/debian/bind9?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:9.18.11-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / bind9

Package

Name
bind9
Purl
pkg:deb/debian/bind9?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:9.18.11-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / bind9

Package

Name
bind9
Purl
pkg:deb/debian/bind9?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:9.18.11-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}