PatchTheCVEbind vulnerabilities and fixes
Recent CVEs affecting bind, with upgrade or downgrade steps. 4 tracked.
bind has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2023-06-21. Highest priority: CVE-2023-2828 (score 59/100).
- CVE-2023-2828 HIGH 7.5 UPGRADE MITIGATE Every `named` instance configured to run as a recursive resolver maintains a cache database holding the respon
- CVE-2023-2911 HIGH 7.5 UPGRADE MITIGATE If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes
- CVE-2023-2829 HIGH 7.5 UPGRADE MITIGATE A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSS
- CVE-2006-2073 MEDIUM 5.0 DOWNGRADE Unspecified vulnerability in ISC BIND allows remote attackers to cause a denial of service via a crafted DNS m
FAQ
How do I fix bind vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is bind being exploited right now?
None of the tracked bind CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which bind CVE should I patch first?
CVE-2023-2828 currently ranks highest (59/100): Every `named` instance configured to run as a recursive resolver maintains a cache database holding the respon.