CVE-2022-1183

Destroying a TLS session early causes assertion failure

High · published May 19, 2022

CVSS v3.1
7.5
EPSS
6%
Percentile
93.6
In the wild
Unconfirmed
What it is

On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that include a reference to http within the listen-on statements in their named.conf. TLS is used by both DNS over TLS (DoT) and DNS over HTTPS (DoH), but configurations using DoT alone are unaffected. Affects BIND 9.18.0 -> 9.18.2 and version 9.19.0 of the BIND 9.19 development branch.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.06266 · 93.6th percentile
Published
2022-05-19T09:55Z
EPSS history
Timeline
  • 19 MAY 09:55Z
    Destroying a TLS session early causes assertion failure
    cvelistv5