CVE-2020-8624: canonical ubuntu_linux Improper Privilege Management
Vulnerability summary
CVE-2020-8624 is a medium (CVSS 4.3) Improper Privilege Management vulnerability in canonical ubuntu_linux. EPSS estimates a 3.67% chance of exploitation in the next 30 days, higher than 89.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 11 · Related 8Timeline
- 21-08-2020PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone.
CVSS metrics
8 scores · 7 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
3.67%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.67% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- bind9< 1:9.16.6-1
- debian_linuxEOL10.0
Isc2 products
- bind≥ 9.9.12, ≤ 9.9.13 | ≥ 9.10.7, ≤ 9.10.8 | ≥ 9.11.3, ≤ 9.11.21 | ≥ 9.12.1, ≤ 9.16.5 | ≥ 9.17.0, ≤ 9.17.3 | 9.9.12:s1 | 9.9.13:s1 | 9.11.3:s1 | 9.11.21:s1
- bind9≥ 9.9.12, < unspecified | ≥ unspecified, ≤ 9.9.13 | ≥ 9.10.7, < unspecified | ≥ unspecified, ≤ 9.10.8 | ≥ 9.11.3, < unspecified | ≥ unspecified, < 9.11.22 | ≥ 9.12.1, < unspecified | ≥ unspecified, < 9.16.6 | ≥ 9.17.0, < unspecified | ≥ unspecified, < 9.17.4 | ≥ 9.9.12-S1, < unspecified | ≥ unspecified, ≤ 9.9.13-S1 | ≥ 9.11.3-S1, < unspecified | ≥ unspecified, < 9.11.22-S1
Alpine1 product
- bind≥ 9.9.12, < 9.16.6-r0
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 20.04
Chainguard1 product
- bindAll versions (No fix recorded)
Fedoraproject1 product
- fedoraEOL31 | 32
Netapp1 product
Opensuse1 product
- leapEOL15.1 | 15.2
Ubuntu1 product
- bind9< 1:9.11.3+dfsg-1ubuntu1.13 | < 1:9.16.1-0ubuntu2.3
Wolfi1 product
- bindAll versions (No fix recorded)
10 vendors · 12 products
References
16 links
- lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.htmlVendor AdvisoryX Refsource SUSEAdvisoryMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.htmlVendor AdvisoryX Refsource SUSEAdvisoryMailing ListThird Party Advisory
