CVE-2021-25220: 
NixOS vulnerability analysis and mitigation

A cache poisoning vulnerability (CVE-2021-25220) was discovered in BIND versions 9.11.0 through 9.11.36, 9.12.0 through 9.16.26, 9.17.0 through 9.18.0, and BIND Supported Preview Editions. The vulnerability affects BIND when using forwarders, where bogus NS records supplied by the forwarders may be cached and used by name servers (ISC KB, MITRE CVE).

The vulnerability exists in BIND's DNS forwarding functionality where incorrect records could be cached, leading to queries being directed to the wrong servers. The issue has been assigned a CVSS base score of 6.8 (MEDIUM) with a vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N (NetApp Advisory).

When successfully exploited, this vulnerability could result in the DNS cache becoming poisoned with incorrect records, potentially causing queries to be made to incorrect servers and false information being returned to clients. This could lead to addition or modification of DNS data (Red Hat CVE).

The vulnerability has been fixed in subsequent releases of BIND. Organizations should upgrade to patched versions of the software. For BIND 9.16.x, upgrade to version 9.16.27 or later. For BIND 9.11.x, upgrade to version 9.11.37 or later (Debian Security).