CVE-2022-2795

CVE-2022-2795

Medium · published September 21, 2022

CVSS v3.1
5.3
EPSS
2%
Percentile
83.1
In the wild
Unconfirmed
What it is

By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.02291 · 83.1th percentile
Published
2022-09-21T15:15Z
Affected products (35)
ProductVersionsFixed in
isc/bind≥ 9.0.0, < 9.16.339.16.33
isc/bind≥ 9.18.0, < 9.18.79.18.7
isc/bind≥ 9.19.0, < 9.19.59.19.5
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
isc/bindall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
References (17)
http://www.openwall.com/lists/oss-security/2022/09/21/3 · [email protected]https://kb.isc.org/docs/cve-2022-2795 · [email protected]https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/ · [email protected]https://security.gentoo.org/glsa/202210-25 · [email protected]https://www.debian.org/security/2022/dsa-5235 · [email protected]http://www.openwall.com/lists/oss-security/2022/09/21/3 · af854a3a-2127-422b-91ae-364da2661108https://kb.isc.org/docs/cve-2022-2795 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/ · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202210-25 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20241129-0002/ · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5235 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 21 SEP 10:15Z
    Processing large delegations may severely degrade resolver performance
    cvelistv5