CVE-2020-8623

A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c

High · published August 21, 2020

CVSS v3.1
7.5
EPSS
7%
Percentile
93.8
In the wild
Unconfirmed
What it is

In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with "--enable-native-pkcs11" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.06631 · 93.8th percentile
Published
2020-08-21T20:50Z
EPSS history
Timeline
  • 21 AUG 20:50Z
    A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c
    cvelistv5