CVE-2020-8619: 
NixOS vulnerability analysis and mitigation

CVE-2020-8619 is a vulnerability discovered in BIND (Berkeley Internet Name Domain), affecting versions 9.11.4 prior to 9.11.20, 9.11.4-S1 prior to 9.11.20-S1, 9.14.9 through 9.14.12, and 9.16.0 prior to 9.16.4. The vulnerability involves an asterisk character in an empty non-terminal that can trigger an assertion failure in rbtdb.c (Red Hat Advisory, Ubuntu Notice).

The vulnerability occurs when BIND incorrectly handles certain asterisk characters in zone files, which can lead to an assertion failure in lib/dns/rbtdb.c:new_reference(). The vulnerability has been assigned a CVSS score of 4.9 (Medium) with a vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H (NetApp Advisory).

When successfully exploited, this vulnerability can cause BIND to crash, resulting in a denial of service (DoS). The impact is particularly significant for DNS servers as it affects their availability and could disrupt name resolution services (Ubuntu Notice, NetApp Advisory).

The vulnerability requires an attacker who is allowed to change zone content to theoretically introduce a record that could exploit this condition. The attack requires high privileges but low attack complexity to execute (NetApp Advisory).

The vulnerability has been fixed in BIND version 9.16.6. Various vendors have released patches and updates to address this vulnerability. Red Hat has released security updates for RHEL 8, Ubuntu has provided updates for version 20.04 LTS (package version 1:9.16.1-0ubuntu2.2), and Debian has fixed the issue in version 1:9.11.5.P4+dfsg-5.1+deb10u2 (Red Hat Advisory, Ubuntu Notice, Debian Advisory).