CVE-2022-2881 | THREATINT

Description

The underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process.

Reserved 2022-08-17 | Published 2022-09-21 | Updated 2024-09-17 | Assigner isc

MEDIUM: 5.5CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H

Problem types

In BIND 9.18.0 -> 9.18.6 and versions 9.19.0 -> 9.19.4 of the BIND 9.19 development branch, when an HTTP connection was reused to request statistics from the stats channel, the content length of successive responses could grow in size past the end of the allocated buffer.

Product status

Open Source Branch 9.18 9.18.0 through versions before 9.18.7

affected

Development Branch 9.19 9.19.0 through versions before 9.19.5

affected

References

kb.isc.org/docs/cve-2022-2881

www.openwall.com/lists/oss-security/2022/09/21/3 ([oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178)) mailing-list

security.gentoo.org/glsa/202210-25 (GLSA-202210-25) vendor-advisory

cve.org (CVE-2022-2881)

nvd.nist.gov (CVE-2022-2881)

Download JSON