5.3

CVE-2022-2795: debian debian_linux

CVSS: 5.3v3.1MediumModified
AliasesALPINE-CVE-2022-2795RHSA-2023:3002UBUNTU-CVE-2022-2795
Published 21-09-2022Last modified 29-11-2024
Open JSON

Vulnerability summary

CVE-2022-2795 is a medium (CVSS 5.3) vulnerability in debian debian_linux. EPSS estimates a 2.21% chance of exploitation in the next 30 days, higher than 82.3% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
2.21%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 15 · Related 10
DLA-3138-1DSA-5235-1MGASA-2022-0388OPENSUSE-SU-2024:12356-1RHSA-2023:0402RHSA-2023:2261

Timeline

  1. 21-09-2022
    PublishedVulnerability first disclosed.
  2. 29-11-2024
    Last modifiedVulnerability information updated.

Description

By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

2.21%

Chance of exploitation in the next 30 days

Percentile

82%

Versus all other CVEs

30-day change

+0.02 pp

From 2.20% on 18-09-2026

18-09-202618-10-2026
EPSS score
2.21%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Redhat27 products
  • bind< 32:9.11.36-8.el8
  • bind-chroot< 32:9.11.36-8.el8
  • bind-debuginfo< 32:9.11.36-8.el8
  • bind-debugsource< 32:9.11.36-8.el8
  • bind-devel< 32:9.11.36-8.el8
Ubuntu3 products
  • bind9< 1:9.9.5.dfsg-3ubuntu0.19+esm7 | < 1:9.10.3.dfsg.P4-8ubuntu1.19+esm3 | < 1:9.11.3+dfsg-1ubuntu1.18 | < 1:9.16.1-0ubuntu2.11 | < 1:9.18.1-1ubuntu1.2
  • bind9-libsAll versions (No fix recorded)
  • isc-dhcpAll versions (No fix recorded)
Debian2 products
Isc2 products
  • bind≥ 9.0.0, < 9.16.33 | ≥ 9.18.0, < 9.18.7 | ≥ 9.19.0, < 9.19.5 | 9.9.3:s1 | 9.9.12:s1 | 9.9.13:s1 | 9.10.5:s1 | 9.10.7:s1 | 9.11.3:s1 | 9.11.5:s3 | 9.11.5:s5 | 9.11.5:s6 | 9.11.6:s1 | 9.11.7:s1 | 9.11.8:s1 | 9.11.12:s1 | 9.11.14-s1 | 9.11.19-s1 | 9.11.21:s1 | 9.11.27:s1 | 9.11.29:s1 | 9.11.35:s1 | 9.11.37:s1 | 9.16.8:s1 | 9.16.11:s1 | 9.16.13:s1 | 9.16.21:s1 | 9.16.32:s1
  • bind9Open Source Branches 9.0 through 9.16 9.0.0 through versions before 9.16.33 | Open Source Branch 9.18 9.18.0 through versions before 9.18.7 | Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions up to and including 9.11.37-S1 | Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1 | Development Branch 9.19 9.19.0 through versions before 9.19.5
Alpine1 product
  • bind≥ 9.0.0, < 9.16.33-r0 | ≥ 9.0.0, < 9.18.7-r0
Chainguard1 product
  • bindAll versions (No fix recorded)
Fedoraproject1 product
Wolfi1 product
  • bindAll versions (No fix recorded)

8 vendors · 38 products

References

24 links
Show all 24 references