CVE-2017-3142: Debian Linux

Low severity, CVSS 3.7. EPSS: 5.4% chance of exploitation in the next 30 days.

An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• ISC BIND: from 9.4.0, up to and including 9.8.8; from 9.9.0, up to and including 9.9.10; from 9.10.0, up to and including 9.10.5; from 9.11.0, up to and including 9.11.1; version 9.9.0 only; version 9.9.3 only; …
• Red Hat Enterprise Linux Desktop: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux Server: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux Server Aus: version 7.3 only; version 7.4 only; version 7.6 only
• Red Hat Enterprise Linux Server Eus: version 7.3 only; version 7.4 only; version 7.5 only; version 7.6 only
• Red Hat Enterprise Linux Server Tus: version 7.3 only; version 7.6 only
• Red Hat Enterprise Linux Workstation: version 6.0 only; version 7.0 only

Published 2019-01-16. Last modified 2026-06-17.