WaratekVRT Sign in

CVE-2020-8623 BIND

Affected softwareBIND
Severity7.5 High CVSS 3.1 3 scores
WeaknessCWE-617
Published21 Aug 2020
Updated17 Jun 2026

Description

In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with "--enable-native-pkcs11" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 6 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 6.6% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H security-officer@isc.org Secondary published
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD Primary
CVSS 2.0 4.3 none AV:N/AC:M/Au:N/C:N/I:N/A:P NVD Primary

Affected software and releases

Products and versions

7 products, 16 version entries
SourceVendorProductSchemeAffected versions
nvd canonical ubuntu linux generic 16.04 · 18.04 · 20.04
nvd debian debian linux generic 9.0 · 10.0
nvd fedoraproject fedora generic 31 · 32
nvd isc bind generic ≥ 9.10.0 and ≤ 9.11.21 · 9.10.5:s1 · 9.11.21:s1 · ≥ 9.12.1 and ≤ 9.16.5 · ≥ 9.17.0 and ≤ 9.17.3
nvd netapp steelstore cloud integrated storage generic any version
nvd opensuse leap generic 15.1 · 15.2
nvd synology dns server generic ＜ 2.2.2.5027

References

URLTags
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html Mailing List, Third Party Advisory
https://kb.isc.org/docs/cve-2020-8623 Vendor Advisory
https://lists.debian.org/debian-lts-announce/2020/08/msg00053.html Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQN62GBMCIC5AY4KYADGXNKVY6AJKSJE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKAMJZXR66P6S5LEU4SN7USSNCWTXEXP/
https://security.gentoo.org/glsa/202008-19 Third Party Advisory
https://security.netapp.com/advisory/ntap-20200827-0003/ Third Party Advisory
https://usn.ubuntu.com/4468-1/ Third Party Advisory
https://www.debian.org/security/2020/dsa-4752 Third Party Advisory

Timeline
Published2020-08-21By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.