CVE-2020-8624
In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to…
Does this matter?
Lower severity and a low EPSS score (3.67%). Track it; it rarely justifies an emergency change on its own.
Description
In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 3.67% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-269
- Affected
- isc/bind · netapp/steelstore cloud integrated storage · canonical/ubuntu linux · debian/debian linux · fedoraproject/fedora · opensuse/leap
- Source
- security-officer@isc.org
References
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.htmlMailing List, Third Party Advisory
- https://kb.isc.org/docs/cve-2020-8624Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQN62GBMCIC5AY4KYADGXNKVY6AJKSJE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKAMJZXR66P6S5LEU4SN7USSNCWTXEXP/
- https://security.gentoo.org/glsa/202008-19Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200827-0003/Third Party Advisory
- https://usn.ubuntu.com/4468-1/Third Party Advisory
- https://www.debian.org/security/2020/dsa-4752Third Party Advisory
- https://www.synology.com/security/advisory/Synology_SA_20_19Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.htmlMailing List, Third Party Advisory
- https://kb.isc.org/docs/cve-2020-8624Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQN62GBMCIC5AY4KYADGXNKVY6AJKSJE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKAMJZXR66P6S5LEU4SN7USSNCWTXEXP/
- https://security.gentoo.org/glsa/202008-19Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200827-0003/Third Party Advisory
- https://usn.ubuntu.com/4468-1/Third Party Advisory
- https://www.debian.org/security/2020/dsa-4752Third Party Advisory
- https://www.synology.com/security/advisory/Synology_SA_20_19Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.