{
  "threat_severity" : "Moderate",
  "public_date" : "2022-03-16T00:00:00Z",
  "bugzilla" : {
    "description" : "bind: DNS forwarders - cache poisoning vulnerability",
    "id" : "2064512",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2064512"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-444",
  "details" : [ "BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.", "A cache poisoning vulnerability was found in BIND when using forwarders. Bogus NS records supplied by the forwarders may be cached and used by name if it needs to recurse for any reason. This issue causes it to obtain and pass on potentially incorrect answers. This flaw allows a remote high privileged attacker to manipulate cache results with incorrect records, leading to queries made to the wrong servers, possibly resulting in false information received on the client's end." ],
  "statement" : "Versions of BIND shipped with Red Hat Enterprise Linux 8, 9 are affected, because vulnerable code is present in our code base. \nFor RHEL-9, DHCP uses the vulnerable BIND 9 libraries (bind-9.11.14) for some services. Hence, it is affected as well.\nAuthoritative - Only BIND 9 servers are not vulnerable to this flaw.",
  "acknowledgement" : "Upstream acknowledges Baojun Liu (Network and Information Security Lab, Tsinghua University), Changgen Zou (Qi An Xin Group Corp), Chaoyi Lu (Network and Information Security Lab, Tsinghua University), and Xiang Li (Network and Information Security Lab, Tsinghua University) as the original reporters.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION",
    "release_date" : "2025-12-17T00:00:00Z",
    "advisory" : "RHSA-2025:23414",
    "cpe" : "cpe:/o:redhat:rhel_els:6",
    "package" : "bind-32:9.8.2-0.68.rc1.el6_10.17"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2023-01-24T00:00:00Z",
    "advisory" : "RHSA-2023:0402",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "bind-32:9.11.4-26.P2.el7_9.13"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2022-11-08T00:00:00Z",
    "advisory" : "RHSA-2022:7643",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "bind9.16-32:9.16.23-0.9.el8.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2022-11-08T00:00:00Z",
    "advisory" : "RHSA-2022:7790",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "bind-32:9.11.36-5.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2022-11-08T00:00:00Z",
    "advisory" : "RHSA-2022:7790",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "bind-32:9.11.36-5.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.2 Advanced Update Support",
    "release_date" : "2025-11-19T00:00:00Z",
    "advisory" : "RHSA-2025:21741",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.2",
    "package" : "bind-32:9.11.13-6.el8_2.11"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
    "release_date" : "2025-11-19T00:00:00Z",
    "advisory" : "RHSA-2025:21740",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.4",
    "package" : "bind-32:9.11.26-4.el8_4.8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
    "release_date" : "2025-11-19T00:00:00Z",
    "advisory" : "RHSA-2025:21740",
    "cpe" : "cpe:/a:redhat:rhel_eus_long_life:8.4",
    "package" : "bind-32:9.11.26-4.el8_4.8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2025-11-26T00:00:00Z",
    "advisory" : "RHSA-2025:22168",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.6",
    "package" : "bind9.16-32:9.16.23-0.7.el8_6.9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Extended Update Support",
    "release_date" : "2024-05-07T00:00:00Z",
    "advisory" : "RHSA-2024:2720",
    "cpe" : "cpe:/a:redhat:rhel_eus:8.6",
    "package" : "bind-32:9.11.36-3.el8_6.7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Extended Update Support",
    "release_date" : "2024-05-07T00:00:00Z",
    "advisory" : "RHSA-2024:2720",
    "cpe" : "cpe:/a:redhat:rhel_eus:8.6",
    "package" : "dhcp-12:4.3.6-47.el8_6.2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
    "release_date" : "2025-11-26T00:00:00Z",
    "advisory" : "RHSA-2025:22168",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.6",
    "package" : "bind9.16-32:9.16.23-0.7.el8_6.9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
    "release_date" : "2025-11-26T00:00:00Z",
    "advisory" : "RHSA-2025:22168",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.6",
    "package" : "bind9.16-32:9.16.23-0.7.el8_6.9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2022-11-15T00:00:00Z",
    "advisory" : "RHSA-2022:8068",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "bind-32:9.16.23-5.el9_1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2022-11-15T00:00:00Z",
    "advisory" : "RHSA-2022:8385",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "dhcp-12:4.4.2-17.b1.el9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2025-11-20T00:00:00Z",
    "advisory" : "RHSA-2025:21889",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.0",
    "package" : "bind-32:9.16.23-1.el9_0.11"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2021-25220\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-25220\nhttps://kb.isc.org/docs/CVE-2021-25220" ],
  "name" : "CVE-2021-25220",
  "mitigation" : {
    "value" : "If applicable, modify your configuration to either remove all forwarding or all possibility of recursion. Depending on your use case, it may be possible to use other zone types to replace forward zones.",
    "lang" : "en:us"
  },
  "csaw" : false
}