CVE-2020-8616

Name	CVE-2020-8616
Description	A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2227-1, DSA-4689-1, ELA-230-1
Debian Bugs	961939

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
bind9 (PTS)	jessie, jessie (lts)	1:9.9.5.dfsg-9+deb8u31	fixed
	stretch (security)	1:9.10.3.dfsg.P4-12.3+deb9u12	fixed
	stretch (lts), stretch	1:9.10.3.dfsg.P4-12.3+deb9u17	fixed
	buster, buster (lts)	1:9.11.5.P4+dfsg-5.1+deb10u13	fixed
	buster (security)	1:9.11.5.P4+dfsg-5.1+deb10u11	fixed
	bullseye	1:9.16.50-1~deb11u2	fixed
	bullseye (security)	1:9.16.50-1~deb11u1	fixed
	bookworm (security), bookworm	1:9.18.28-1~deb12u2	fixed
	trixie	1:9.20.4-2	fixed
	sid	1:9.20.4-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
bind9	source	wheezy	1:9.8.4.dfsg.P1-6+nmu2+deb7u24	ELA-230-1
bind9	source	jessie	1:9.9.5.dfsg-9+deb8u19	DLA-2227-1
bind9	source	stretch	1:9.10.3.dfsg.P4-12.3+deb9u6	DSA-4689-1
bind9	source	buster	1:9.11.5.P4+dfsg-5.1+deb10u1	DSA-4689-1
bind9	source	(unstable)	1:9.16.3-1		961939

https://kb.isc.org/docs/cve-2020-8616