description: In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to trigger the assertion failure, causing the server to exit.
problem types:   In versions of BIND that use the libuv network manager (9.16.x is the only stable branch affected) an incorrectly specified maximum buffer size allows a specially crafted large TCP payload to trigger an assertion failure when it is received.  Affects BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3
affected:
{
product: BIND9
vendor: ISC
versions:
changes: [at: 9.16.6, status: unaffected], lessThan: *, status: affected, version: 9.15.6, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
exploits: We are not aware of any active exploits.
solutions: Upgrade to the patched release most closely related to your current version of BIND:
BIND 9.16.6
BIND 9.17.4
workarounds: No workarounds known.