Reachable Assertion in ISC BIND - CVE-2022-1183
Published: May 18, 2022
Vulnerability identifier: #VU63409
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-1183
CWE-ID: CWE-617
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a reachable assertion that can be triggered if a TLS connection to a configured http TLS listener with a defined endpoint is destroyed too early. A remote attacker can send specially crafted request and perform a denial of service (DoS) attack.
Affected software
ISC BIND
Ubuntu
HPE Moonshot 1500 Chassis Manager
bind9 (Ubuntu package)
Ubuntu
HPE Moonshot 1500 Chassis Manager
bind9 (Ubuntu package)
How to mitigate CVE-2022-1183
Install updates from vendor's website.
ISC BIND - addressed in versions 9.18.3, 9.19.1
HPE Moonshot 1500 Chassis Manager - update to 4.0-b43
bind9 (Ubuntu package) - update to 1:9.18.1-1ubuntu1.1
HPE Moonshot 1500 Chassis Manager - update to 4.0-b43
bind9 (Ubuntu package) - update to 1:9.18.1-1ubuntu1.1