[<prev] [next>] [day] [month] [year] [list]
Message-ID: <86ea5d79-08bb-4999-b123-d4936823acd4@isc.org>
Date: Wed, 29 Jan 2025 17:57:50 +0100
From: Matthijs Mekking <matthijs@....org>
To: oss-security@...ts.openwall.com
Cc: security-officer@....org
Subject: ISC has disclosed two vulnerabilities in BIND 9 (CVE-2024-11187,
CVE-2024-12705)
On 29 January 2025 we (Internet Systems Consortium) disclosed two
vulnerabilities affecting our BIND 9 software:
- CVE-2024-11187: Many records in the additional section cause CPU
exhaustion https://kb.isc.org/docs/cve-2024-11187
- CVE-2024-12705: DNS-over-HTTPS implementation suffers from
multiple issues under heavy query load
https://kb.isc.org/docs/cve-2024-12705
New versions of BIND 9 are available from https://www.isc.org/downloads
Operators and package maintainers who prefer to apply patches
selectively can find individual vulnerability-specific patches in the
"patches" subdirectory of each published release directory:
- https://downloads.isc.org/isc/bind9/9.18.33/patches/
- https://downloads.isc.org/isc/bind9/9.20.5/patches/
- https://downloads.isc.org/isc/bind9/9.21.4/patches/
With the public announcement of these vulnerabilities, the embargo
period is ended and any updated software packages that have been
prepared may be released.
Download attachment "OpenPGP_0xD507944581A036B9.asc" of type "application/pgp-keys" (2441 bytes)
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (666 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
