ALAS2023-2025-1255

References: CVE-2025-40778  CVE-2025-40780  CVE-2025-8677 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.
This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. (CVE-2025-40778)

In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.
This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. (CVE-2025-40780)

Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. (CVE-2025-8677)

Issue Correction:
Run dnf update bind --releasever 2023.9.20251105 or dnf update --advisory ALAS2023-2025-1255 --releasever 2023.9.20251105 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    bind-dnssec-utils-9.18.33-1.amzn2023.0.4.aarch64
    bind-libs-debuginfo-9.18.33-1.amzn2023.0.4.aarch64
    bind-utils-debuginfo-9.18.33-1.amzn2023.0.4.aarch64
    bind-debuginfo-9.18.33-1.amzn2023.0.4.aarch64
    bind-chroot-9.18.33-1.amzn2023.0.4.aarch64
    bind-debugsource-9.18.33-1.amzn2023.0.4.aarch64
    bind-dnssec-utils-debuginfo-9.18.33-1.amzn2023.0.4.aarch64
    bind-libs-9.18.33-1.amzn2023.0.4.aarch64
    bind-9.18.33-1.amzn2023.0.4.aarch64
    bind-utils-9.18.33-1.amzn2023.0.4.aarch64
    bind-devel-9.18.33-1.amzn2023.0.4.aarch64

noarch:
    bind-license-9.18.33-1.amzn2023.0.4.noarch
    bind-doc-9.18.33-1.amzn2023.0.4.noarch

src:
    bind-9.18.33-1.amzn2023.0.4.src

x86_64:
    bind-libs-debuginfo-9.18.33-1.amzn2023.0.4.x86_64
    bind-utils-debuginfo-9.18.33-1.amzn2023.0.4.x86_64
    bind-chroot-9.18.33-1.amzn2023.0.4.x86_64
    bind-devel-9.18.33-1.amzn2023.0.4.x86_64
    bind-dnssec-utils-9.18.33-1.amzn2023.0.4.x86_64
    bind-dnssec-utils-debuginfo-9.18.33-1.amzn2023.0.4.x86_64
    bind-debugsource-9.18.33-1.amzn2023.0.4.x86_64
    bind-debuginfo-9.18.33-1.amzn2023.0.4.x86_64
    bind-libs-9.18.33-1.amzn2023.0.4.x86_64
    bind-utils-9.18.33-1.amzn2023.0.4.x86_64
    bind-9.18.33-1.amzn2023.0.4.x86_64