CVE-2020-8622: Canonical Ubuntu Linux

Medium severity, CVSS 6.5. EPSS: 5.6% chance of exploitation in the next 30 days.

In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 18.04 only; version 20.04 only
• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 31 only; version 32 only
• ISC BIND: from 9.0.0, up to and including 9.11.21; from 9.12.0, up to and including 9.16.5; from 9.17.0, up to and including 9.17.3; version 9.9.3 only; version 9.11.21 only
• Netapp Steelstore Cloud Integrated Storage: affected versions not specified
• Opensuse Leap: version 15.1 only; version 15.2 only
• Oracle Communications Diameter Signaling Router: from 8.0.0, up to and including 8.5.0
• Synology DNS Server: before 2.2.2-5028 (fixed in 2.2.2-5028)

Published 2020-08-21. Last modified 2026-06-17.