CVE-2020-8617

Name	CVE-2020-8617
Description	Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2227-1, DSA-4689-1, ELA-230-1
Debian Bugs	961939

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
bind9 (PTS)	jessie, jessie (lts)	1:9.9.5.dfsg-9+deb8u31	fixed
	stretch (security)	1:9.10.3.dfsg.P4-12.3+deb9u12	fixed
	stretch (lts), stretch	1:9.10.3.dfsg.P4-12.3+deb9u17	fixed
	buster, buster (lts)	1:9.11.5.P4+dfsg-5.1+deb10u13	fixed
	buster (security)	1:9.11.5.P4+dfsg-5.1+deb10u11	fixed
	bullseye	1:9.16.50-1~deb11u2	fixed
	bullseye (security)	1:9.16.50-1~deb11u1	fixed
	bookworm (security), bookworm	1:9.18.28-1~deb12u2	fixed
	trixie	1:9.20.4-2	fixed
	sid	1:9.20.4-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
bind9	source	wheezy	1:9.8.4.dfsg.P1-6+nmu2+deb7u24	ELA-230-1
bind9	source	jessie	1:9.9.5.dfsg-9+deb8u19	DLA-2227-1
bind9	source	stretch	1:9.10.3.dfsg.P4-12.3+deb9u6	DSA-4689-1
bind9	source	buster	1:9.11.5.P4+dfsg-5.1+deb10u1	DSA-4689-1
bind9	source	(unstable)	1:9.16.3-1		961939

https://kb.isc.org/docs/cve-2020-8617
https://kb.isc.org/docs/cve-2020-8617-faq-and-supplemental-information