What is the CVSS score of CVE-2021-25214?

CVE-2021-25214 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 5.9%.

Is there a patch available for CVE-2021-25214?

Yes, a patch is available for CVE-2021-25214. Update the affected software to the latest version immediately.

Bind CVE-2021-25214

MEDIUM

Reachable Assertion (CWE-617)

2021-04-29 security-officer@isc.org

Denial Of Service Bind Debian Linux Fedora Sinec Infrastructure Network Services Active Iq Unified Manager Cloud Backup Aff A250 Firmware Aff 500F Firmware H300s Firmware H500s Firmware H700s Firmware H300E Firmware H500E Firmware H700E Firmware H410s Firmware

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Apr 29, 2021 - 01:15 nvd

MEDIUM 6.5

DescriptionNVD

In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-617. In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed. Affected products include: Isc Bind, Debian Debian Linux, Fedoraproject Fedora, Siemens Sinec Infrastructure Network Services, Netapp Active Iq Unified Manager.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.