vulnerability

Oracle Linux: CVE-2020-8624: ELSA-2020-4500: bind security, bug fix, and enhancement update (MODERATE) (Multiple Advisories)

Try Surface Command

Back to search

Severity	CVSS	Published	Added	Modified
4	(AV:N/AC:L/Au:S/C:N/I:P/A:N)	Aug 20, 2020	Nov 12, 2020	Dec 3, 2025

Severity

CVSS

(AV:N/AC:L/Au:S/C:N/I:P/A:N)

Published

Aug 20, 2020

Added

Nov 12, 2020

Modified

Dec 3, 2025

Description

In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone.
A flaw was found in bind. Updates to "Update-policy" rules of type "subdomain" are treated as if they were of type "zonesub" which allows updates to all parts of the zone along with the intended subdomain. The highest threat from this vulnerability is to data integrity.

Solutions

oracle-linux-upgrade-bindoracle-linux-upgrade-bind-chrootoracle-linux-upgrade-bind-develoracle-linux-upgrade-bind-export-develoracle-linux-upgrade-bind-export-libsoracle-linux-upgrade-bind-libsoracle-linux-upgrade-bind-libs-liteoracle-linux-upgrade-bind-licenseoracle-linux-upgrade-bind-lite-develoracle-linux-upgrade-bind-pkcs11oracle-linux-upgrade-bind-pkcs11-develoracle-linux-upgrade-bind-pkcs11-libsoracle-linux-upgrade-bind-pkcs11-utilsoracle-linux-upgrade-bind-sdboracle-linux-upgrade-bind-sdb-chrootoracle-linux-upgrade-bind-utilsoracle-linux-upgrade-python3-bind

References

NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today