CVE-2020-8623

A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c

HIGH

7.5

CVSS Score

Published: August 21, 2020 at 08:50 PM UTC

Updated: June 17, 2026 at 03:26 AM UTC

7 products affected across 7 vendorsDebian LinuxFedoraUbuntu Linux

Using BIND9 by ISC?

Get instant alerts when new vulnerabilities affect BIND9 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 7%

Description

In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with "--enable-native-pkcs11" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ubuntu Linux · Canonicalrubygems

95%

16.04 18.04 20.04

Debian Linux · Debiandrupal

95%

10.0 9.0

Fedora · Fedora Projectrpm

95%

31 32

BIND · Isc

95%

v ≥ 9.10.0v ≥ 9.12.0v ≥ 9.17.0v < 9.11.22v < 9.16.6v < 9.17.49.10.0 ≤ v ≤ 9.11.219.10.5-S1 ≤ v < Supported Preview*9.12.1 ≤ v ≤ 9.16.59.17.0 ≤ v ≤ 9.17.39.10.0 9.10.5 s19.10.5-S19.11.21 s1 9.12.0 9.17.0

Affected range stops below 9.11.22, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.16.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.17.4, so it looks safe — our inference, not a vendor statement

Affected range stops below Supported Preview*, so it looks safe — our inference, not a vendor statement

Steelstore Cloud Integrated Storage · NetApp

95%

All versions

Leap · openSUSEdrupal

95%

15.1 15.2

DNS Server · Synology

95%