Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2022-1183

Destroying a TLS session early causes assertion failure

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
isc

Description

On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that include a reference to http within the listen-on statements in their named.conf. TLS is used by both DNS over TLS (DoT) and DNS over HTTPS (DoH), but configurations using DoT alone are unaffected. Affects BIND 9.18.0 -> 9.18.2 and version 9.19.0 of the BIND 9.19 development branch.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ISC BIND9

  • Open Source Branch 9.18 9.18.0 through versions before 9.18.3affected
  • Development Branch 9.19 9.19.0affected

References