CVE-2024-1737

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-1737", "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22", "state": "PUBLISHED", "assignerShortName": "isc", "dateReserved": "2024-02-22T10:11:43.508Z", "datePublished": "2024-07-23T14:34:09.750Z", "dateUpdated": "2025-02-13T17:32:25.755Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404fd4d2-a609-4245-b543-2c944a302a22", "shortName": "isc", "dateUpdated": "2024-07-31T11:05:54.006Z"}, "title": "BIND's database will be slow if a very large number of RRs exist at the same name", "datePublic": "2024-07-23T00:00:00.000Z", "affected": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"version": "9.11.0", "lessThanOrEqual": "9.11.37", "status": "affected", "versionType": "custom"}, {"version": "9.16.0", "lessThanOrEqual": "9.16.50", "status": "affected", "versionType": "custom"}, {"version": "9.18.0", "lessThanOrEqual": "9.18.27", "status": "affected", "versionType": "custom"}, {"version": "9.19.0", "lessThanOrEqual": "9.19.24", "status": "affected", "versionType": "custom"}, {"version": "9.11.4-S1", "lessThanOrEqual": "9.11.37-S1", "status": "affected", "versionType": "custom"}, {"version": "9.16.8-S1", "lessThanOrEqual": "9.16.50-S1", "status": "affected", "versionType": "custom"}, {"version": "9.18.11-S1", "lessThanOrEqual": "9.18.27-S1", "status": "affected", "versionType": "custom"}], "defaultStatus": "unaffected"}], "metrics": [{"cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "descriptions": [{"lang": "en", "value": "Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Processing of queries may be slowed down by a factor of 100."}]}], "workarounds": [{"lang": "en", "value": "No workarounds known."}], "exploits": [{"lang": "en", "value": "We are not aware of any active exploits."}], "solutions": [{"lang": "en", "value": "Upgrade to the patched release most closely related to your current version of BIND 9: 9.18.28, 9.20.0, or 9.18.28-S1."}], "credits": [{"lang": "en", "value": "ISC would like to thank Toshifumi Sakaguchi for bringing this vulnerability to our attention."}], "references": [{"url": "https://kb.isc.org/docs/cve-2024-1737", "name": "CVE-2024-1737", "tags": ["vendor-advisory"]}, {"url": "https://kb.isc.org/docs/rrset-limits-in-zones", "name": "RRset limits in zones", "tags": ["related"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/07/23/1"}, {"url": "http://www.openwall.com/lists/oss-security/2024/07/31/2"}], "source": {"discovery": "EXTERNAL"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-770", "lang": "en", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "affected": [{"vendor": "isc", "product": "bind", "cpes": ["cpe:2.3:a:isc:bind:9.11.0:*:*:*:*:*:*:*", "cpe:2.3:a:isc:bind:9.11.4:s1:*:*:supported_preview:*:*:*", "cpe:2.3:a:isc:bind:9.16.0:*:*:*:*:*:*:*", "cpe:2.3:a:isc:bind:9.16.8:s1:*:*:*:*:*:*", "cpe:2.3:a:isc:bind:9.18.0:*:*:*:-:*:*:*", "cpe:2.3:a:isc:bind:9.18.11:s1:*:*:supported_preview:*:*:*", "cpe:2.3:a:isc:bind:9.19.0:*:*:*:-:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "9.11.0", "status": "affected", "lessThanOrEqual": "9.11.37", "versionType": "custom"}, {"version": "9.11.4", "status": "affected", "lessThanOrEqual": "9.16.50", "versionType": "custom"}, {"version": "9.16.0", "status": "affected", "lessThanOrEqual": "9.18.27", "versionType": "custom"}, {"version": "9.16.8", "status": "affected", "lessThanOrEqual": "9.19.24", "versionType": "custom"}, {"version": "9.18.0", "status": "affected", "lessThanOrEqual": "9.11.37_s1", "versionType": "custom"}, {"version": "9.18.11", "status": "affected", "lessThanOrEqual": "9.16.50_s1", "versionType": "custom"}, {"version": "9.19.0", "status": "affected", "lessThanOrEqual": "9.18.27_s1", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-26T17:27:11.436620Z", "id": "CVE-2024-1737", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-26T17:35:12.133Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20240731-0003/"}, {"url": "https://kb.isc.org/docs/cve-2024-1737", "name": "CVE-2024-1737", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://kb.isc.org/docs/rrset-limits-in-zones", "name": "RRset limits in zones", "tags": ["related", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/07/23/1", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:48:21.779Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20240731-0003/"}, {"url": "https://kb.isc.org/docs/cve-2024-1737", "name": "CVE-2024-1737", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://kb.isc.org/docs/rrset-limits-in-zones", "name": "RRset limits in zones", "tags": ["related", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/07/23/1", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:48:21.779Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1737", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-26T17:27:11.436620Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:isc:bind:9.11.0:*:*:*:*:*:*:*", "cpe:2.3:a:isc:bind:9.11.4:s1:*:*:supported_preview:*:*:*", "cpe:2.3:a:isc:bind:9.16.0:*:*:*:*:*:*:*", "cpe:2.3:a:isc:bind:9.16.8:s1:*:*:*:*:*:*", "cpe:2.3:a:isc:bind:9.18.0:*:*:*:-:*:*:*", "cpe:2.3:a:isc:bind:9.18.11:s1:*:*:supported_preview:*:*:*", "cpe:2.3:a:isc:bind:9.19.0:*:*:*:-:*:*:*"], "vendor": "isc", "product": "bind", "versions": [{"status": "affected", "version": "9.11.0", "versionType": "custom", "lessThanOrEqual": "9.11.37"}, {"status": "affected", "version": "9.11.4", "versionType": "custom", "lessThanOrEqual": "9.16.50"}, {"status": "affected", "version": "9.16.0", "versionType": "custom", "lessThanOrEqual": "9.18.27"}, {"status": "affected", "version": "9.16.8", "versionType": "custom", "lessThanOrEqual": "9.19.24"}, {"status": "affected", "version": "9.18.0", "versionType": "custom", "lessThanOrEqual": "9.11.37_s1"}, {"status": "affected", "version": "9.18.11", "versionType": "custom", "lessThanOrEqual": "9.16.50_s1"}, {"status": "affected", "version": "9.19.0", "versionType": "custom", "lessThanOrEqual": "9.18.27_s1"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-23T20:43:26.422Z"}}], "cna": {"title": "BIND's database will be slow if a very large number of RRs exist at the same name", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "value": "ISC would like to thank Toshifumi Sakaguchi for bringing this vulnerability to our attention."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Processing of queries may be slowed down by a factor of 100."}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"status": "affected", "version": "9.11.0", "versionType": "custom", "lessThanOrEqual": "9.11.37"}, {"status": "affected", "version": "9.16.0", "versionType": "custom", "lessThanOrEqual": "9.16.50"}, {"status": "affected", "version": "9.18.0", "versionType": "custom", "lessThanOrEqual": "9.18.27"}, {"status": "affected", "version": "9.19.0", "versionType": "custom", "lessThanOrEqual": "9.19.24"}, {"status": "affected", "version": "9.11.4-S1", "versionType": "custom", "lessThanOrEqual": "9.11.37-S1"}, {"status": "affected", "version": "9.16.8-S1", "versionType": "custom", "lessThanOrEqual": "9.16.50-S1"}, {"status": "affected", "version": "9.18.11-S1", "versionType": "custom", "lessThanOrEqual": "9.18.27-S1"}], "defaultStatus": "unaffected"}], "exploits": [{"lang": "en", "value": "We are not aware of any active exploits."}], "solutions": [{"lang": "en", "value": "Upgrade to the patched release most closely related to your current version of BIND 9: 9.18.28, 9.20.0, or 9.18.28-S1."}], "datePublic": "2024-07-23T00:00:00.000Z", "references": [{"url": "https://kb.isc.org/docs/cve-2024-1737", "name": "CVE-2024-1737", "tags": ["vendor-advisory"]}, {"url": "https://kb.isc.org/docs/rrset-limits-in-zones", "name": "RRset limits in zones", "tags": ["related"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/07/23/1"}, {"url": "http://www.openwall.com/lists/oss-security/2024/07/31/2"}], "workarounds": [{"lang": "en", "value": "No workarounds known."}], "descriptions": [{"lang": "en", "value": "Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1."}], "providerMetadata": {"orgId": "404fd4d2-a609-4245-b543-2c944a302a22", "shortName": "isc", "dateUpdated": "2024-07-31T11:05:54.006Z"}}}, "cveMetadata": {"cveId": "CVE-2024-1737", "state": "PUBLISHED", "dateUpdated": "2025-02-13T17:32:25.755Z", "dateReserved": "2024-02-22T10:11:43.508Z", "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22", "datePublished": "2024-07-23T14:34:09.750Z", "assignerShortName": "isc"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "BIND 9", "vendor": "ISC", "versions": [{"lessThanOrEqual": "9.11.37", "status": "affected", "version": "9.11.0", "versionType": "custom"}, {"lessThanOrEqual": "9.16.50", "status": "affected", "version": "9.16.0", "versionType": "custom"}, {"lessThanOrEqual": "9.18.27", "status": "affected", "version": "9.18.0", "versionType": "custom"}, {"lessThanOrEqual": "9.19.24", "status": "affected", "version": "9.19.0", "versionType": "custom"}, {"lessThanOrEqual": "9.11.37-S1", "status": "affected", "version": "9.11.4-S1", "versionType": "custom"}, {"lessThanOrEqual": "9.16.50-S1", "status": "affected", "version": "9.16.8-S1", "versionType": "custom"}, {"lessThanOrEqual": "9.18.27-S1", "status": "affected", "version": "9.18.11-S1", "versionType": "custom"}]}], "source": "security-officer@isc.org"}, {"affectedData": [{"cpes": ["cpe:2.3:a:isc:bind:9.11.0:*:*:*:*:*:*:*", "cpe:2.3:a:isc:bind:9.11.4:s1:*:*:supported_preview:*:*:*", "cpe:2.3:a:isc:bind:9.16.0:*:*:*:*:*:*:*", "cpe:2.3:a:isc:bind:9.16.8:s1:*:*:*:*:*:*", "cpe:2.3:a:isc:bind:9.18.0:*:*:*:-:*:*:*", "cpe:2.3:a:isc:bind:9.18.11:s1:*:*:supported_preview:*:*:*", "cpe:2.3:a:isc:bind:9.19.0:*:*:*:-:*:*:*"], "defaultStatus": "unaffected", "product": "bind", "vendor": "isc", "versions": [{"lessThanOrEqual": "9.11.37", "status": "affected", "version": "9.11.0", "versionType": "custom"}, {"lessThanOrEqual": "9.16.50", "status": "affected", "version": "9.11.4", "versionType": "custom"}, {"lessThanOrEqual": "9.18.27", "status": "affected", "version": "9.16.0", "versionType": "custom"}, {"lessThanOrEqual": "9.19.24", "status": "affected", "version": "9.16.8", "versionType": "custom"}, {"lessThanOrEqual": "9.11.37_s1", "status": "affected", "version": "9.18.0", "versionType": "custom"}, {"lessThanOrEqual": "9.16.50_s1", "status": "affected", "version": "9.18.11", "versionType": "custom"}, {"lessThanOrEqual": "9.18.27_s1", "status": "affected", "version": "9.19.0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1."}, {"lang": "es", "value": " Las cach\u00e9s de resoluci\u00f3n y las bases de datos de zonas autorizadas que contienen cantidades significativas de RR para el mismo nombre de host (de cualquier RTYPE) pueden sufrir un rendimiento degradado a medida que se agrega o actualiza contenido, y tambi\u00e9n al manejar consultas de clientes para este nombre. Este problema afecta a las versiones de BIND 9, 9.11.0 a 9.11.37, 9.16.0 a 9.16.50, 9.18.0 a 9.18.27, 9.19.0 a 9.19.24, 9.11.4-S1 a 9.11.37-S1. 9.16.8-S1 a 9.16.50-S1 y 9.18.11-S1 a 9.18.27-S1."}], "id": "CVE-2024-1737", "lastModified": "2026-06-17T07:04:53.993", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-officer@isc.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-1737", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-07-26T17:27:11.436620Z", "version": "2.0.3"}}]}, "published": "2024-07-23T15:15:03.740", "references": [{"source": "security-officer@isc.org", "url": "http://www.openwall.com/lists/oss-security/2024/07/23/1"}, {"source": "security-officer@isc.org", "url": "http://www.openwall.com/lists/oss-security/2024/07/31/2"}, {"source": "security-officer@isc.org", "url": "https://kb.isc.org/docs/cve-2024-1737"}, {"source": "security-officer@isc.org", "url": "https://kb.isc.org/docs/rrset-limits-in-zones"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2024/07/23/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://kb.isc.org/docs/cve-2024-1737"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://kb.isc.org/docs/rrset-limits-in-zones"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20240731-0003/"}], "sourceIdentifier": "security-officer@isc.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2024:5894", "cpe": "cpe:/o:redhat:rhel_aus:7.7", "package": "bind-32:9.11.4-9.P2.el7_7.7", "product_name": "Red Hat Enterprise Linux 7.7 Advanced Update Support", "release_date": "2024-08-27T00:00:00Z"}, {"advisory": "RHSA-2024:5930", "cpe": "cpe:/o:redhat:rhel_els:7", "package": "bind-32:9.11.4-26.P2.el7_9.17", "product_name": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "release_date": "2024-08-28T00:00:00Z"}, {"advisory": "RHSA-2024:5390", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "bind9.16-32:9.16.23-0.22.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-08-14T00:00:00Z"}, {"advisory": "RHSA-2024:5524", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "bind-32:9.11.36-16.el8_10.2", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-08-19T00:00:00Z"}, {"advisory": "RHSA-2024:5524", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "bind-32:9.11.36-16.el8_10.2", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-08-19T00:00:00Z"}, {"advisory": "RHSA-2024:5655", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "bind-32:9.11.13-6.el8_2.9", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2024-08-20T00:00:00Z"}, {"advisory": "RHSA-2024:5871", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "bind-32:9.11.26-4.el8_4.6", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2024-08-26T00:00:00Z"}, {"advisory": "RHSA-2024:5871", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "bind-32:9.11.26-4.el8_4.6", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2024-08-26T00:00:00Z"}, {"advisory": "RHSA-2024:5871", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "bind-32:9.11.26-4.el8_4.6", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2024-08-26T00:00:00Z"}, {"advisory": "RHSA-2024:5418", "cpe": "cpe:/a:redhat:rhel_aus:8.6", "package": "bind9.16-32:9.16.23-0.7.el8_6.6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2024-08-15T00:00:00Z"}, {"advisory": "RHSA-2024:5908", "cpe": "cpe:/a:redhat:rhel_aus:8.6", "package": "bind-32:9.11.36-3.el8_6.9", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2024-08-27T00:00:00Z"}, {"advisory": "RHSA-2024:5418", "cpe": "cpe:/a:redhat:rhel_tus:8.6", "package": "bind9.16-32:9.16.23-0.7.el8_6.6", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2024-08-15T00:00:00Z"}, {"advisory": "RHSA-2024:5908", "cpe": "cpe:/a:redhat:rhel_tus:8.6", "package": "bind-32:9.11.36-3.el8_6.9", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2024-08-27T00:00:00Z"}, {"advisory": "RHSA-2024:5418", "cpe": "cpe:/a:redhat:rhel_e4s:8.6", "package": "bind9.16-32:9.16.23-0.7.el8_6.6", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2024-08-15T00:00:00Z"}, {"advisory": "RHSA-2024:5908", "cpe": "cpe:/a:redhat:rhel_e4s:8.6", "package": "bind-32:9.11.36-3.el8_6.9", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2024-08-27T00:00:00Z"}, {"advisory": "RHSA-2024:5525", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "bind9.16-32:9.16.23-0.14.el8_8.5", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-08-19T00:00:00Z"}, {"advisory": "RHSA-2024:5838", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "bind-32:9.11.36-8.el8_8.6", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-08-26T00:00:00Z"}, {"advisory": "RHSA-2024:5231", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "bind-32:9.16.23-18.el9_4.6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-08-15T00:00:00Z"}, {"advisory": "RHSA-2024:5231", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "bind-dyndb-ldap-0:11.9-10.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-08-15T00:00:00Z"}, {"advisory": "RHSA-2024:5907", "cpe": "cpe:/a:redhat:rhel_e4s:9.0", "package": "bind-32:9.16.23-1.el9_0.7", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2024-08-27T00:00:00Z"}, {"advisory": "RHSA-2024:5907", "cpe": "cpe:/a:redhat:rhel_e4s:9.0", "package": "bind-dyndb-ldap-0:11.9-7.el9_0.3", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2024-08-27T00:00:00Z"}, {"advisory": "RHSA-2024:5813", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "bind-32:9.16.23-11.el9_2.5", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-08-26T00:00:00Z"}, {"advisory": "RHSA-2024:5813", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "bind-dyndb-ldap-0:11.9-8.el9_2.3", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-08-26T00:00:00Z"}, {"advisory": "RHSA-2024:6642", "cpe": "cpe:/a:redhat:openshift:4.12::el8", "package": "rhcos-412.86.202409111316-0", "product_name": "Red Hat OpenShift Container Platform 4.12", "release_date": "2024-09-18T00:00:00Z"}, {"advisory": "RHSA-2024:6009", "cpe": "cpe:/a:redhat:openshift:4.13::el9", "package": "rhcos-413.92.202408270922-0", "product_name": "Red Hat OpenShift Container Platform 4.13", "release_date": "2024-09-04T00:00:00Z"}, {"advisory": "RHSA-2024:6406", "cpe": "cpe:/a:redhat:openshift:4.14::el9", "package": "rhcos-414.92.202409041930-0", "product_name": "Red Hat OpenShift Container Platform 4.14", "release_date": "2024-09-11T00:00:00Z"}, {"advisory": "RHSA-2024:6013", "cpe": "cpe:/a:redhat:openshift:4.15::el9", "package": "rhcos-415.92.202408271217-0", "product_name": "Red Hat OpenShift Container Platform 4.15", "release_date": "2024-09-05T00:00:00Z"}, {"advisory": "RHSA-2024:6004", "cpe": "cpe:/a:redhat:openshift:4.16::el9", "package": "rhcos-416.94.202408260940-0", "product_name": "Red Hat OpenShift Container Platform 4.16", "release_date": "2024-09-03T00:00:00Z"}], "bugzilla": {"description": "bind: bind9: BIND's database will be slow if a very large number of RRs exist at the same nam", "id": "2298893", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2298893"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-400", "details": ["Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.", "A flaw was found in the bind9 package, where a hostname with significant resource records may slow down bind's resolver cache and authoritative zone databases while these records are being added or updated. In addition, client queries for the related hostname may cause the same issue. This vulnerability may lead to a denial of service."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-1737", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "bind9.18", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "dhcp", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-1737\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-1737"], "statement": "The identified flaw in the bind9 package represents a significant severity issue due to its potential to disrupt DNS resolution services. Specifically, a hostname with an extensive number of resource records can substantially degrade the performance of bind's resolver cache and authoritative zone databases. This degradation occurs during the addition or updating of these records, and is further exacerbated by client queries, which can lead to resource exhaustion. Consequently, the system may experience increased latency or complete unavailability of DNS services, resulting in a Denial of Service (DoS).\nThe DHCP package as shipped with Red Hat Enterprise 9 is not affected by this vulnerability. Although the DHCP binary ships bundled versions of bind libraries, the DHCP application uses its own routines to DDNS and configuration meaning the affected code is not reachable through it.", "threat_severity": "Important"}

{}