CVE-2022-1183
CVE-2022-1183 · Destroying a TLS session early causes assertion failure
This page contains facts from public vulnerability sources. Check the original advisory before updating.
On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that include a reference to http within the listen-on statements in their named.conf. TLS is used by both DNS over TLS (DoT) and DNS over HTTPS (DoH), but configurations using DoT alone are unaffected. Affects BIND 9.18.0 -> 9.18.2 and version 9.19.0 of the BIND 9.19 development branch.
CVSS 7.5 · High · EPSS 6.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
bind9
- Versions
- Open Source Branch 9.18 9.18.0 through versions before 9.18.3: Affected
- Development Branch 9.19 9.19.0: Affected
No fix published
bind9 Debian:12
- Affected ranges
- ECOSYSTEM: < 1:9.18.3-1
Update to 1:9.18.3-1
bind9 Debian:13
- Affected ranges
- ECOSYSTEM: < 1:9.18.3-1
Update to 1:9.18.3-1
bind9 Debian:14
- Affected ranges
- ECOSYSTEM: < 1:9.18.3-1
Update to 1:9.18.3-1
bind9 Ubuntu:22.04:LTS
- Versions
- 1:9.16.15-1ubuntu1
- 1:9.16.15-1ubuntu2
- 1:9.16.15-1ubuntu3
- 1:9.18.0-2ubuntu1
- 1:9.18.0-2ubuntu2
- 1:9.18.0-2ubuntu3
- 1:9.18.1-1ubuntu1
- Affected ranges
- ECOSYSTEM: < 1:9.18.1-1ubuntu1.1
Update to 1:9.18.1-1ubuntu1.1