PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2022-38177

CVE-2022-38177

bind: memory leak in ECDSA DNSSEC verification code

Loading…

Severity

Important

Red Hat Product Security

7.5

CVSS 3.1

Review impact separately from score.

Published · September 21, 2022

Updated · November 21, 2025

Description

A flaw was found in the Bind package. By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak, resulting in crashing the program.

Statement

This flaw affects versions 9.8.4 -> 9.16.32 of the Bind package, therefore Red Hat Enterprise Linux 6 is not affected.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-401 · Missing Release of Memory after Effective Lifetime