RHSA-2025:1670HighCVSS 7.5

Red Hat Security Advisory: bind9.18 security update

Published
February 19, 2025
Last Modified
November 5, 2026

🔗 CVE IDs covered (2)

CVE-2024-11187 →CVE-2024-12705 →

📋 Description

CVE-2024-11187 — bind: bind9: Many records in the additional section cause CPU exhaustion CVE-2024-12705 — bind: bind9: DNS-over-HTTPS implementation suffers from multiple issues under heavy query load

🎯 Affected products75

  • Red Hat CodeReady Linux Builder (v. 9)
  • Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-32:9.18.29-1.el9_5.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-32:9.18.29-1.el9_5.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-32:9.18.29-1.el9_5.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-32:9.18.29-1.el9_5.1.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-32:9.18.29-1.el9_5.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-chroot-32:9.18.29-1.el9_5.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-chroot-32:9.18.29-1.el9_5.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-chroot-32:9.18.29-1.el9_5.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-chroot-32:9.18.29-1.el9_5.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-debuginfo-32:9.18.29-1.el9_5.1.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind9.18-debuginfo-32:9.18.29-1.el9_5.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-debuginfo-32:9.18.29-1.el9_5.1.i686 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind9.18-debuginfo-32:9.18.29-1.el9_5.1.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind9.18-debuginfo-32:9.18.29-1.el9_5.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-debuginfo-32:9.18.29-1.el9_5.1.s390x as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind9.18-debuginfo-32:9.18.29-1.el9_5.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-debuginfo-32:9.18.29-1.el9_5.1.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind9.18-debuginfo-32:9.18.29-1.el9_5.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-debugsource-32:9.18.29-1.el9_5.1.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind9.18-debugsource-32:9.18.29-1.el9_5.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-debugsource-32:9.18.29-1.el9_5.1.i686 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind9.18-debugsource-32:9.18.29-1.el9_5.1.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind9.18-debugsource-32:9.18.29-1.el9_5.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-debugsource-32:9.18.29-1.el9_5.1.s390x as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind9.18-debugsource-32:9.18.29-1.el9_5.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-debugsource-32:9.18.29-1.el9_5.1.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bind9.18-debugsource-32:9.18.29-1.el9_5.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-devel-32:9.18.29-1.el9_5.1.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • +45 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Users can set the option `minimal-responses yes;`in the configuration file located at `/etc/named.conf`to mitigate this vulnerability. Workaround: If the feature is not needed, disable DNS-over-HTTPS (DoH) in your bind config. Otherwise, we recommend upgrading to a patched version of bind.

🔗 References (5)