CVE-2020-8624

update-policy rules of type "subdomain" are enforced incorrectly

MEDIUM

4.3

CVSS Score

Published: August 21, 2020 at 08:50 PM UTC

Updated: June 17, 2026 at 03:26 AM UTC

6 products affected across 6 vendorsDebian LinuxFedoraUbuntu Linux

Using BIND9 by ISC?

Get instant alerts when new vulnerabilities affect BIND9 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM4.3

Exploit prediction

EPSS 4%

Description

In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ubuntu Linux · Canonicalrubygems

95%

16.04 18.04 20.04

Debian Linux · Debiandrupal

95%

10.0

Fedora · Fedora Projectrpm

95%

31 32

BIND · Isc

95%

v ≥ 9.10.7v ≥ 9.11.3v ≥ 9.11.3-S1v ≥ 9.12.1v ≥ 9.17.0v ≥ 9.9.12v ≥ 9.9.12-S1v ≤ 9.10.8v ≤ 9.9.13v ≤ 9.9.13-S1v < 9.11.22v < 9.11.22-S1v < 9.16.6v < 9.17.49.10.7 ≤ v ≤ 9.10.89.11.3 ≤ v ≤ 9.11.219.12.1 ≤ v ≤ 9.16.59.17.0 ≤ v ≤ 9.17.39.9.12 ≤ v ≤ 9.9.139.10.7 9.11.21 s1 9.11.3 9.11.3 s1 9.11.3-S1 9.12.1 9.17.0 9.9.12 9.9.12 s19.9.12-S19.9.13 s1

Affected range stops below 9.11.22, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.11.22-S1, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.16.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.17.4, so it looks safe — our inference, not a vendor statement

Steelstore Cloud Integrated Storage · NetApp

95%

All versions

Leap · openSUSEdrupal

95%

15.1 15.2