Skip to content
Fencer Intel
high 8.6

CVE-2020-8616 in the critical feed json

BIND does not sufficiently limit the number of fetches performed when processing referrals

published 6y ago modified 4mo ago also EUVD-2020-29464

cvss
8.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
10.9%
EPSS 10.9% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor.

Patch / fix

  • bind9 Debian 14, Debian 13, Debian 12 1:9.16.3-1

debian advisories DEBIAN-CVE-2020-8616

  • bind9 Ubuntu 16.04 LTS 1:9.10.3.dfsg.P4-8ubuntu1.16
  • bind9 Ubuntu 18.04 LTS 1:9.11.3+dfsg-1ubuntu1.12
  • bind9 Ubuntu 20.04 LTS 1:9.16.1-0ubuntu2.1
  • bind9 Ubuntu Pro 14.04 LTS 1:9.9.5.dfsg-3ubuntu0.19+esm2

ubuntu advisories UBUNTU-CVE-2020-8616

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • bind RHEL 6 32:9.8.2-0.68.rc1.el6_10.7
  • bind-sdb RHEL 6 32:9.8.2-0.68.rc1.el6_10.7
  • bind-libs RHEL 6 32:9.8.2-0.68.rc1.el6_10.7
  • bind-utils RHEL 6 32:9.8.2-0.68.rc1.el6_10.7
  • bind-chroot RHEL 6 32:9.8.2-0.68.rc1.el6_10.7
  • bind RHEL 7 32:9.11.4-16.P2.el7_8.6
  • bind-sdb RHEL 7 32:9.11.4-16.P2.el7_8.6
  • bind-libs RHEL 7 32:9.11.4-16.P2.el7_8.6

red hat advisories RHSA-2020:3433RHSA-2020:3379RHSA-2020:3378RHSA-2020:3272RHSA-2020:2404RHSA-2020:2383

  • bind SLES for SAP 15, SLES 15-LTSS, SLE Module for Server Applications 15 SP2 +5 more 9.16.6-12.32.1
  • sysuser-tools SLES for SAP 15, SLES 15-LTSS, SLE Module for Development Tools 15 SP2 +4 more 2.0-4.2.8
  • bind SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES 12 SP3-LTSS +8 more 9.9.9P1-63.17.1
  • bind SLES 11 SP4-LTSS, SLE Point of Sale 11 SP3 9.9.6P1-0.51.20.1
  • bind SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +3 more 9.11.2-3.17.1

suse advisories SUSE-SU-2020:2914-1SUSE-SU-2020:1914-1SUSE-SU-2020:14400-1SUSE-SU-2020:1350-1

  • bind openSUSE Tumbleweed 9.16.20-1.4
  • bind openSUSE Leap 15.1 9.16.6-lp151.11.9.1
  • libuv openSUSE Leap 15.1 1.18.0-lp151.3.3.1
  • sysuser-tools openSUSE Leap 15.1 2.0-lp151.4.3.1
  • bind openSUSE Leap 15.2 9.16.6-lp152.14.3.1
  • libuv openSUSE Leap 15.2 1.18.0-lp152.4.3.1
  • sysuser-tools openSUSE Leap 15.2 2.0-lp152.5.3.1

opensuse advisories openSUSE-SU-2024:10650-1openSUSE-SU-2020:1701-1openSUSE-SU-2020:1699-1

  • bind Alpine 3.24, Alpine 3.23, Alpine 3.22 +12 more 9.14.12-r0

alpine advisories ALPINE-CVE-2020-8616

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • bind Arch Linux 9.16.3-1

arch linux advisories AVG-1165

Is CVE-2020-8616 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-8616 updated cvss 8.6

bind: BIND does not sufficiently limit the number of fetches performed when processing referrals

  • Red Hat Enterprise Linux 5 bind, bind97
    affected: workaround, no fix planned “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.”
  • Red Hat Enterprise Linux AppStream (v. 8) bind 9.11.13-5.el8_2, bind-sdb 9.11.13-5.el8_2, bind-libs 9.11.13-5.el8_2, bind-utils 9.11.13-5.el8_2, bind-chroot 9.11.13-5.el8_2, bind-pkcs11 9.11.13-5.el8_2, +6 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:2338
  • Red Hat Enterprise Linux AppStream E4S (v. 8.0) bind 9.11.4-19.P2.el8_0, bind-sdb 9.11.4-19.P2.el8_0, bind-libs 9.11.4-19.P2.el8_0, bind-utils 9.11.4-19.P2.el8_0, bind-chroot 9.11.4-19.P2.el8_0, bind-pkcs11 9.11.4-19.P2.el8_0, +6 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:2404
  • Red Hat Enterprise Linux AppStream EUS (v. 8.1) bind 9.11.4-26.P2.el8_1.3, bind-sdb 9.11.4-26.P2.el8_1.3, bind-libs 9.11.4-26.P2.el8_1.3, bind-utils 9.11.4-26.P2.el8_1.3, bind-chroot 9.11.4-26.P2.el8_1.3, bind-pkcs11 9.11.4-26.P2.el8_1.3, +6 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:2345
  • Red Hat Enterprise Linux BaseOS (v. 8) bind 9.11.13-5.el8_2, bind-export-libs 9.11.13-5.el8_2
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:2338
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.0) bind 9.11.4-19.P2.el8_0, bind-export-libs 9.11.4-19.P2.el8_0
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:2404
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.1) bind 9.11.4-26.P2.el8_1.3, bind-export-libs 9.11.4-26.P2.el8_1.3
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:2345
  • Red Hat Enterprise Linux Client (v. 7) bind 9.11.4-16.P2.el7_8.6, bind-libs 9.11.4-16.P2.el7_8.6, bind-utils 9.11.4-16.P2.el7_8.6, bind-license 9.11.4-16.P2.el7_8.6, bind-libs-lite 9.11.4-16.P2.el7_8.6, bind-export-libs 9.11.4-16.P2.el7_8.6 Red Hat Enterprise Linux Client Optional (v. 7) bind 9.11.4-16.P2.el7_8.6, bind-sdb 9.11.4-16.P2.el7_8.6, bind-chroot 9.11.4-16.P2.el7_8.6, bind-pkcs11 9.11.4-16.P2.el7_8.6, bind-sdb-chroot 9.11.4-16.P2.el7_8.6, bind-pkcs11-libs 9.11.4-16.P2.el7_8.6, +1 more Red Hat Enterprise Linux ComputeNode (v. 7) bind 9.11.4-16.P2.el7_8.6, bind-libs 9.11.4-16.P2.el7_8.6, bind-utils 9.11.4-16.P2.el7_8.6, bind-license 9.11.4-16.P2.el7_8.6, bind-libs-lite 9.11.4-16.P2.el7_8.6, bind-export-libs 9.11.4-16.P2.el7_8.6
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:2344
show 26 more
  • Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) bind 9.9.4-74.el7_6.4, bind-libs 9.9.4-74.el7_6.4, bind-utils 9.9.4-74.el7_6.4, bind-license 9.9.4-74.el7_6.4, bind-libs-lite 9.9.4-74.el7_6.4
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3475
  • Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) bind 9.11.4-9.P2.el7_7.2, bind-libs 9.11.4-9.P2.el7_7.2, bind-utils 9.11.4-9.P2.el7_7.2, bind-license 9.11.4-9.P2.el7_7.2, bind-libs-lite 9.11.4-9.P2.el7_7.2, bind-export-libs 9.11.4-9.P2.el7_7.2
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3272
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7) bind 9.11.4-16.P2.el7_8.6, bind-sdb 9.11.4-16.P2.el7_8.6, bind-chroot 9.11.4-16.P2.el7_8.6, bind-pkcs11 9.11.4-16.P2.el7_8.6, bind-sdb-chroot 9.11.4-16.P2.el7_8.6, bind-pkcs11-libs 9.11.4-16.P2.el7_8.6, +1 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:2344
  • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) bind 9.9.4-74.el7_6.4, bind-sdb 9.9.4-74.el7_6.4, bind-chroot 9.9.4-74.el7_6.4, bind-pkcs11 9.9.4-74.el7_6.4, bind-sdb-chroot 9.9.4-74.el7_6.4, bind-pkcs11-libs 9.9.4-74.el7_6.4, +1 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3475
  • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) bind 9.11.4-9.P2.el7_7.2, bind-sdb 9.11.4-9.P2.el7_7.2, bind-chroot 9.11.4-9.P2.el7_7.2, bind-pkcs11 9.11.4-9.P2.el7_7.2, bind-sdb-chroot 9.11.4-9.P2.el7_7.2, bind-pkcs11-libs 9.11.4-9.P2.el7_7.2, +1 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3272
  • Red Hat Enterprise Linux Desktop (v. 6) bind 9.8.2-0.68.rc1.el6_10.7, bind-libs 9.8.2-0.68.rc1.el6_10.7, bind-utils 9.8.2-0.68.rc1.el6_10.7 Red Hat Enterprise Linux Desktop Optional (v. 6) bind 9.8.2-0.68.rc1.el6_10.7, bind-sdb 9.8.2-0.68.rc1.el6_10.7, bind-chroot 9.8.2-0.68.rc1.el6_10.7
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:2383
  • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) bind 9.9.4-74.el7_6.4, bind-libs 9.9.4-74.el7_6.4, bind-utils 9.9.4-74.el7_6.4, bind-chroot 9.9.4-74.el7_6.4, bind-pkcs11 9.9.4-74.el7_6.4, bind-license 9.9.4-74.el7_6.4, +3 more Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) bind-sdb 9.9.4-74.el7_6.4, bind-pkcs11 9.9.4-74.el7_6.4, bind-sdb-chroot 9.9.4-74.el7_6.4, bind-pkcs11-libs 9.9.4-74.el7_6.4, bind-pkcs11-utils 9.9.4-74.el7_6.4
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3475
  • Red Hat Enterprise Linux HPC Node (v. 6) bind 9.8.2-0.68.rc1.el6_10.7, bind-libs 9.8.2-0.68.rc1.el6_10.7, bind-utils 9.8.2-0.68.rc1.el6_10.7 Red Hat Enterprise Linux HPC Node Optional (v. 6) bind 9.8.2-0.68.rc1.el6_10.7, bind-sdb 9.8.2-0.68.rc1.el6_10.7, bind-chroot 9.8.2-0.68.rc1.el6_10.7 Red Hat Enterprise Linux Server (v. 6) bind 9.8.2-0.68.rc1.el6_10.7, bind-libs 9.8.2-0.68.rc1.el6_10.7, bind-utils 9.8.2-0.68.rc1.el6_10.7, bind-chroot 9.8.2-0.68.rc1.el6_10.7
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:2383
  • Red Hat Enterprise Linux Server (v. 7) bind 9.11.4-16.P2.el7_8.6, bind-libs 9.11.4-16.P2.el7_8.6, bind-utils 9.11.4-16.P2.el7_8.6, bind-chroot 9.11.4-16.P2.el7_8.6, bind-pkcs11 9.11.4-16.P2.el7_8.6, bind-license 9.11.4-16.P2.el7_8.6, +4 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:2344
  • Red Hat Enterprise Linux Server AUS (v. 6.5) bind 9.8.2-0.23.rc1.el6_5.9, bind-libs 9.8.2-0.23.rc1.el6_5.9, bind-utils 9.8.2-0.23.rc1.el6_5.9, bind-chroot 9.8.2-0.23.rc1.el6_5.9
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3379
  • Red Hat Enterprise Linux Server AUS (v. 6.6) bind 9.8.2-0.30.rc1.el6_6.11, bind-libs 9.8.2-0.30.rc1.el6_6.11, bind-utils 9.8.2-0.30.rc1.el6_6.11, bind-chroot 9.8.2-0.30.rc1.el6_6.11
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3378
  • Red Hat Enterprise Linux Server AUS (v. 7.2) bind 9.9.4-29.el7_2.9, bind-libs 9.9.4-29.el7_2.9, bind-utils 9.9.4-29.el7_2.9, bind-chroot 9.9.4-29.el7_2.9, bind-pkcs11 9.9.4-29.el7_2.9, bind-license 9.9.4-29.el7_2.9, +3 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3471
  • Red Hat Enterprise Linux Server AUS (v. 7.3) bind 9.9.4-50.el7_3.4, bind-libs 9.9.4-50.el7_3.4, bind-utils 9.9.4-50.el7_3.4, bind-chroot 9.9.4-50.el7_3.4, bind-pkcs11 9.9.4-50.el7_3.4, bind-license 9.9.4-50.el7_3.4, +3 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3470
  • Red Hat Enterprise Linux Server AUS (v. 7.4) bind 9.9.4-51.el7_4.4, bind-libs 9.9.4-51.el7_4.4, bind-utils 9.9.4-51.el7_4.4, bind-chroot 9.9.4-51.el7_4.4, bind-pkcs11 9.9.4-51.el7_4.4, bind-license 9.9.4-51.el7_4.4, +3 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3433
  • Red Hat Enterprise Linux Server E4S (v. 7.3) bind 9.9.4-50.el7_3.4, bind-libs 9.9.4-50.el7_3.4, bind-utils 9.9.4-50.el7_3.4, bind-chroot 9.9.4-50.el7_3.4, bind-pkcs11 9.9.4-50.el7_3.4, bind-license 9.9.4-50.el7_3.4, +3 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3470
  • Red Hat Enterprise Linux Server E4S (v. 7.4) bind 9.9.4-51.el7_4.4, bind-libs 9.9.4-51.el7_4.4, bind-utils 9.9.4-51.el7_4.4, bind-chroot 9.9.4-51.el7_4.4, bind-pkcs11 9.9.4-51.el7_4.4, bind-license 9.9.4-51.el7_4.4, +3 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3433
  • Red Hat Enterprise Linux Server EUS (v. 7.6) bind 9.9.4-74.el7_6.4, bind-libs 9.9.4-74.el7_6.4, bind-utils 9.9.4-74.el7_6.4, bind-chroot 9.9.4-74.el7_6.4, bind-pkcs11 9.9.4-74.el7_6.4, bind-license 9.9.4-74.el7_6.4, +3 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3475
  • Red Hat Enterprise Linux Server EUS (v. 7.7) bind 9.11.4-9.P2.el7_7.2, bind-libs 9.11.4-9.P2.el7_7.2, bind-utils 9.11.4-9.P2.el7_7.2, bind-chroot 9.11.4-9.P2.el7_7.2, bind-pkcs11 9.11.4-9.P2.el7_7.2, bind-license 9.11.4-9.P2.el7_7.2, +4 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3272
  • Red Hat Enterprise Linux Server Optional (v. 6) bind-sdb 9.8.2-0.68.rc1.el6_10.7
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:2383
  • Red Hat Enterprise Linux Server Optional (v. 7) bind-sdb 9.11.4-16.P2.el7_8.6, bind-sdb-chroot 9.11.4-16.P2.el7_8.6
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:2344
  • Red Hat Enterprise Linux Server Optional AUS (v. 6.5) bind 9.8.2-0.23.rc1.el6_5.9, bind-sdb 9.8.2-0.23.rc1.el6_5.9
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3379
  • Red Hat Enterprise Linux Server Optional AUS (v. 6.6) bind-sdb 9.8.2-0.30.rc1.el6_6.11
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3378
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.2) bind-sdb 9.9.4-29.el7_2.9, bind-sdb-chroot 9.9.4-29.el7_2.9
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3471
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.3) bind-sdb 9.9.4-50.el7_3.4, bind-sdb-chroot 9.9.4-50.el7_3.4
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3470
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.4) bind-sdb 9.9.4-51.el7_4.4, bind-sdb-chroot 9.9.4-51.el7_4.4
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3433
  • Red Hat Enterprise Linux Server Optional E4S (v. 7.3) bind-sdb 9.9.4-50.el7_3.4, bind-sdb-chroot 9.9.4-50.el7_3.4
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2020:3470

11 more fixed in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

10.88% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • nxnsattack.com http://www.nxnsattack.com referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • ISC BIND9

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.