OESA-2025-2654

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-2654
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2025-2654.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2025-2654
Upstream
  • CVE-2025-40778
  • CVE-2025-40780
  • CVE-2025-8677
Published
2025-11-14T12:38:14Z
Modified
2025-11-14T13:02:46.414816Z
Summary
bind security update
Details

Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server.

Security Fix(es):

Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.(CVE-2025-40778)

In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.(CVE-2025-40780)

Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.(CVE-2025-8677)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:24.03-LTS-SP1 / bind

Package

Name
bind
Purl
pkg:rpm/openEuler/bind&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.18.21-5.oe2403sp1

Ecosystem specific 

{
    "aarch64": [
        "bind-9.18.21-5.oe2403sp1.aarch64.rpm",
        "bind-chroot-9.18.21-5.oe2403sp1.aarch64.rpm",
        "bind-debuginfo-9.18.21-5.oe2403sp1.aarch64.rpm",
        "bind-debugsource-9.18.21-5.oe2403sp1.aarch64.rpm",
        "bind-devel-9.18.21-5.oe2403sp1.aarch64.rpm",
        "bind-dnssec-utils-9.18.21-5.oe2403sp1.aarch64.rpm",
        "bind-libs-9.18.21-5.oe2403sp1.aarch64.rpm",
        "bind-utils-9.18.21-5.oe2403sp1.aarch64.rpm"
    ],
    "src": [
        "bind-9.18.21-5.oe2403sp1.src.rpm"
    ],
    "noarch": [
        "bind-dnssec-doc-9.18.21-5.oe2403sp1.noarch.rpm",
        "bind-license-9.18.21-5.oe2403sp1.noarch.rpm"
    ],
    "x86_64": [
        "bind-9.18.21-5.oe2403sp1.x86_64.rpm",
        "bind-chroot-9.18.21-5.oe2403sp1.x86_64.rpm",
        "bind-debuginfo-9.18.21-5.oe2403sp1.x86_64.rpm",
        "bind-debugsource-9.18.21-5.oe2403sp1.x86_64.rpm",
        "bind-devel-9.18.21-5.oe2403sp1.x86_64.rpm",
        "bind-dnssec-utils-9.18.21-5.oe2403sp1.x86_64.rpm",
        "bind-libs-9.18.21-5.oe2403sp1.x86_64.rpm",
        "bind-utils-9.18.21-5.oe2403sp1.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2025-2654.json"