Launchpad CVE tracker

CVE 2023-2911

If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33 through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.

Related bugs and status

CVE-2023-2911 (Candidate) is related to these bugs:

Bug #2015176: Ubuntu 22.04.2, nsupdate stopped recognizing HMAC-MD5 key after update from 1:9.18.1-1ubuntu1.3 to 1:9.18.12-0ubuntu0.22.04.1

		In	Importance	Status
2015176	Ubuntu 22.04.2, nsupdate stopped recognizing HMAC-MD5 key after update from 1:9.18.1-1ubuntu1.3 to 1:9.18.12-0ubuntu0.22.04.1	bind9 (Ubuntu)	Undecided	Fix Released
2015176	Ubuntu 22.04.2, nsupdate stopped recognizing HMAC-MD5 key after update from 1:9.18.1-1ubuntu1.3 to 1:9.18.12-0ubuntu0.22.04.1	BIND	Undecided	New
2015176	Ubuntu 22.04.2, nsupdate stopped recognizing HMAC-MD5 key after update from 1:9.18.1-1ubuntu1.3 to 1:9.18.12-0ubuntu0.22.04.1	bind9 (Ubuntu Kinetic)	Undecided	Won't Fix
2015176	Ubuntu 22.04.2, nsupdate stopped recognizing HMAC-MD5 key after update from 1:9.18.1-1ubuntu1.3 to 1:9.18.12-0ubuntu0.22.04.1	bind9 (Ubuntu Jammy)	Undecided	Fix Released
2015176	Ubuntu 22.04.2, nsupdate stopped recognizing HMAC-MD5 key after update from 1:9.18.1-1ubuntu1.3 to 1:9.18.12-0ubuntu0.22.04.1	bind9 (Ubuntu Lunar)	Undecided	Fix Released

Bug #2025013: [Debian] High CVE: CVE-2023-2828/CVE-2023-2911: bind: multiple CVEs

Summary				In	Importance	Status
	2025013	[Debian] High CVE: CVE-2023-2828/CVE-2023-2911: bind: multiple CVEs		StarlingX	High	Fix Released

Bug #2028413: MRE updates of bind9 for focal, jammy and lunar

		In	Importance	Status
2028413	MRE updates of bind9 for focal, jammy and lunar	bind9 (Ubuntu)	Undecided	Fix Released
2028413	MRE updates of bind9 for focal, jammy and lunar	bind9 (Ubuntu Focal)	Undecided	Fix Committed
2028413	MRE updates of bind9 for focal, jammy and lunar	bind9 (Ubuntu Jammy)	Undecided	Fix Released
2028413	MRE updates of bind9 for focal, jammy and lunar	bind9 (Ubuntu Lunar)	Undecided	Fix Released
2028413	MRE updates of bind9 for focal, jammy and lunar	bind-dyndb-ldap (Ubuntu)	Undecided	Fix Released
2028413	MRE updates of bind9 for focal, jammy and lunar	bind-dyndb-ldap (Ubuntu Focal)	Undecided	Won't Fix
2028413	MRE updates of bind9 for focal, jammy and lunar	bind-dyndb-ldap (Ubuntu Jammy)	Undecided	Fix Released
2028413	MRE updates of bind9 for focal, jammy and lunar	bind-dyndb-ldap (Ubuntu Lunar)	Undecided	Fix Released

Bug #2032650: Add DEP8 tests for bind-dyndb-ldap integration

		In	Importance	Status
2032650	Add DEP8 tests for bind-dyndb-ldap integration	bind-dyndb-ldap (Ubuntu)	High	Fix Released
2032650	Add DEP8 tests for bind-dyndb-ldap integration	bind9 (Ubuntu)	High	Fix Released
2032650	Add DEP8 tests for bind-dyndb-ldap integration	bind-dyndb-ldap (Ubuntu Mantic)	High	Fix Released
2032650	Add DEP8 tests for bind-dyndb-ldap integration	bind9 (Ubuntu Mantic)	High	Fix Released
2032650	Add DEP8 tests for bind-dyndb-ldap integration	bind-dyndb-ldap (Ubuntu Lunar)	Undecided	Fix Released
2032650	Add DEP8 tests for bind-dyndb-ldap integration	bind9 (Ubuntu Lunar)	Undecided	Fix Released
2032650	Add DEP8 tests for bind-dyndb-ldap integration	bind-dyndb-ldap (Ubuntu Jammy)	Undecided	Fix Released
2032650	Add DEP8 tests for bind-dyndb-ldap integration	bind9 (Ubuntu Jammy)	Undecided	Fix Released

See the

CVE page on Mitre.org for more details.

Launchpad.net

CVE 2023-2911

References