CVE-2020-8619

A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer

MEDIUM

4.9

CVSS Score

Published: June 17, 2020 at 09:20 PM UTC

Updated: September 1, 2026 at 08:57 PM UTC

6 products affected across 6 vendorsDebian LinuxFedoraUbuntu Linux

Using BIND9 by ISC?

Get instant alerts when new vulnerabilities affect BIND9 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM4.9

Exploit prediction

EPSS 2%

Description

In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk ("*") character, this defect cannot be encountered. A would-be attacker who is allowed to change zone content could theoretically introduce such a record in order to exploit this condition to cause denial of service, though we consider the use of this vector unlikely because any such attack would require a significant privilege level and be easily traceable.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ubuntu Linux · Canonicalrubygems

95%

20.04

Debian Linux · Debiandrupal

95%

10.0

Fedora · Fedora Projectrpm

95%

31 32

BIND · Isc

95%

v < 9.11.20v < 9.11.20-S1v < 9.16.49.11.14 ≤ v ≤ 9.11.199.11.14-s1 ≤ v ≤ 9.11.19-s19.14.9 ≤ v ≤ 9.14.129.16.0 ≤ v ≤ 9.16.39.14.9 through versions 9.14.12

Affected range stops below 9.11.20, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.11.20-S1, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.16.4, so it looks safe — our inference, not a vendor statement

Steelstore Cloud Integrated Storage · NetApp

95%

All versions

Leap · openSUSEdrupal

95%

15.1 15.2