WaratekVRT Sign in

CVE-2020-8619 ISC BIND

Affected softwareISC BIND
Severity4.9 Medium CVSS 3.1 3 scores
WeaknessCWE-404
Published17 Jun 2020
Updated1 Sep 2026

Description

In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk ("*") character, this defect cannot be encountered. A would-be attacker who is allowed to change zone content could theoretically introduce such a record in order to exploit this condition to cause denial of service, though we consider the use of this vector unlikely because any such attack would require a significant privilege level and be easily traceable.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 6 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 2.1% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

4.9 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 4.9 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H security-officer@isc.org Secondary published
CVSS 3.1 4.9 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H NVD Primary
CVSS 2.0 4.0 none AV:N/AC:L/Au:S/C:N/I:N/A:P NVD Primary

Affected software and releases

Products and versions

6 products, 11 version entries
SourceVendorProductSchemeAffected versions
nvd canonical ubuntu linux generic 20.04
nvd debian debian linux generic 10.0
nvd fedoraproject fedora generic 31 · 32
nvd isc bind generic ≥ 9.11.14 and ≤ 9.11.19 · ≥ 9.11.14.1 and ≤ 9.11.19.1 · ≥ 9.14.9 and ≤ 9.14.12 · ≥ 9.16.0 and ≤ 9.16.3
nvd netapp steelstore cloud integrated storage generic any version
nvd opensuse leap generic 15.1 · 15.2

References

URLTags
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html Mailing List, Third Party Advisory
https://kb.isc.org/docs/cve-2020-8619 Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNFTTYJ5JJJJ6QG3AHXJGDIIEYMDFWFW/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EIOXMJX4N3LBKC65OXNBE52W4GAS7QEX/
https://security.netapp.com/advisory/ntap-20200625-0003/ Third Party Advisory
https://usn.ubuntu.com/4399-1/ Third Party Advisory
https://www.debian.org/security/2020/dsa-4752 Third Party Advisory

Timeline
Published2020-06-17By the CVE Program.
NVD record modified2026-09-01NVD's own last-modified date for this record.