CVE-2022-2881 | THREATINT

Assigner	isc
Reserved	2022-08-17
Published	2022-09-21
Updated	2024-09-17

Description

The underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process.

MEDIUM: 5.5

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H

Problem types

In BIND 9.18.0 -> 9.18.6 and versions 9.19.0 -> 9.19.4 of the BIND 9.19 development branch, when an HTTP connection was reused to request statistics from the stats channel, the content length of successive responses could grow in size past the end of the allocated buffer.

Product status

Open Source Branch 9.18 9.18.0 through versions before 9.18.7

affected

Development Branch 9.19 9.19.0 through versions before 9.19.5

affected

References

https://kb.isc.org/docs/cve-2022-2881

http://www.openwall.com/lists/oss-security/2022/09/21/3 ([oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178)) mailing-list

https://security.gentoo.org/glsa/202210-25 (GLSA-202210-25) vendor-advisory

cve.org CVE-2022-2881

nvd.nist.gov CVE-2022-2881

Download JSON