OESA-2022-1615 (CVE-2021-25220)
Vulnerability from osv_openeuler – Published: 2022-04-16 11:04 – Updated: 2026-08-06 11:04 – Source websiteBIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.
Security Fix(es):
BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.(CVE-2021-25220)
BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has terminated the connection.(CVE-2022-0396)
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"bind-debugsource-9.16.23-8.oe2203.aarch64.rpm",
"bind-utils-9.16.23-8.oe2203.aarch64.rpm",
"bind-libs-9.16.23-8.oe2203.aarch64.rpm",
"bind-9.16.23-8.oe2203.aarch64.rpm",
"bind-libs-lite-9.16.23-8.oe2203.aarch64.rpm",
"bind-chroot-9.16.23-8.oe2203.aarch64.rpm",
"bind-export-libs-9.16.23-8.oe2203.aarch64.rpm",
"bind-devel-9.16.23-8.oe2203.aarch64.rpm",
"bind-pkcs11-devel-9.16.23-8.oe2203.aarch64.rpm",
"bind-export-devel-9.16.23-8.oe2203.aarch64.rpm",
"bind-pkcs11-9.16.23-8.oe2203.aarch64.rpm",
"bind-debuginfo-9.16.23-8.oe2203.aarch64.rpm"
],
"noarch": [
"python3-bind-9.16.23-8.oe2203.noarch.rpm"
],
"src": [
"bind-9.16.23-8.oe2203.src.rpm"
],
"x86_64": [
"bind-debuginfo-9.16.23-8.oe2203.x86_64.rpm",
"bind-export-devel-9.16.23-8.oe2203.x86_64.rpm",
"bind-chroot-9.16.23-8.oe2203.x86_64.rpm",
"bind-utils-9.16.23-8.oe2203.x86_64.rpm",
"bind-debugsource-9.16.23-8.oe2203.x86_64.rpm",
"bind-libs-9.16.23-8.oe2203.x86_64.rpm",
"bind-devel-9.16.23-8.oe2203.x86_64.rpm",
"bind-libs-lite-9.16.23-8.oe2203.x86_64.rpm",
"bind-pkcs11-devel-9.16.23-8.oe2203.x86_64.rpm",
"bind-9.16.23-8.oe2203.x86_64.rpm",
"bind-export-libs-9.16.23-8.oe2203.x86_64.rpm",
"bind-pkcs11-9.16.23-8.oe2203.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:22.03-LTS",
"name": "bind",
"purl": "pkg:rpm/openEuler/bind\u0026distro=openEuler-22.03-LTS"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.16.23-8.oe2203"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "Medium"
},
"details": "BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.\r\n\r\nSecurity Fix(es):\r\n\r\nBIND 9.11.0 -\u0026gt; 9.11.36 9.12.0 -\u0026gt; 9.16.26 9.17.0 -\u0026gt; 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -\u0026gt; 9.11.36-S1 9.16.8-S1 -\u0026gt; 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.(CVE-2021-25220)\n\n\nBIND 9.16.11 -\u003e 9.16.26, 9.17.0 -\u003e 9.18.0 and versions 9.16.11-S1 -\u003e 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has terminated the connection.(CVE-2022-0396)",
"id": "OESA-2022-1615",
"modified": "2026-08-06T11:04:53Z",
"published": "2022-04-16T11:04:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1615"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25220"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0396"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "bind security update",
"upstream": [
"CVE-2021-25220",
"CVE-2022-0396"
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.