Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-25202 State: PUBLISHED Published: 2021-07-22T17:10:28 Last Updated: 2024-08-03T19:56:10.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in SourceCodester Sales and Inventory System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to \ahira\admin\inventory.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TCSWT/Sales-and-Inventory-System/blob/main/README.md
CVE ID: CVE-2021-25203 State: PUBLISHED Published: 2021-07-23T13:20:37 Last Updated: 2024-08-03T19:56:10.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arbitrary file upload vulnerability in Victor CMS v 1.0 allows attackers to execute arbitrary code via the file upload to \CMSsite-master\admin\includes\admin_add_post.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TCSWT/Victor-CMS/blob/main/README.md
CVE ID: CVE-2021-25204 State: PUBLISHED Published: 2021-07-23T13:24:30 Last Updated: 2024-08-03T19:56:10.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in SourceCodester E-Commerce Website v 1.0 allows remote attackers to inject arbitrary web script or HTM via the subject field to feedback_process.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BigTiger2020/E-Commerce-Website/blob/main/E-Commerce%20Website-xss.md
CVE ID: CVE-2021-25205 State: PUBLISHED Published: 2021-07-22T19:25:27 Last Updated: 2024-08-03T19:56:10.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in SourceCodester E-Commerce Website V 1.0 allows remote attackers to execute arbitrary SQL statements, via the update parameter to empViewUpdate.php . Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BigTiger2020/E-Commerce-Website/blob/main/E-Commerce%20Website-sql.md
CVE ID: CVE-2021-25206 State: PUBLISHED Published: 2021-07-23T13:15:17 Last Updated: 2024-08-03T19:56:10.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arbitrary file upload vulnerability in SourceCodester Responsive Ordering System v 1.0 allows attackers to execute arbitrary code via the file upload to Product_model.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BigTiger2020/Responsive-Ordering-System/blob/main/Responsive%20Ordering%20System.md
CVE ID: CVE-2021-25207 State: PUBLISHED Published: 2021-07-23T12:59:02 Last Updated: 2024-08-03T19:56:10.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arbitrary file upload vulnerability in SourceCodester E-Commerce Website v 1.0 allows attackers to execute arbitrary code via the file upload to prodViewUpdate.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BigTiger2020/E-Commerce-Website/blob/main/E-Commerce%20Website%20-upload.md
CVE ID: CVE-2021-25208 State: PUBLISHED Published: 2021-07-23T13:04:13 Last Updated: 2024-08-03T19:56:10.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arbitrary file upload vulnerability in SourceCodester Travel Management System v 1.0 allows attackers to execute arbitrary code via the file upload to updatepackage.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BigTiger2020/Travel-Management-System/blob/main/Travel%20Management%20System.md
CVE ID: CVE-2021-25209 State: PUBLISHED Published: 2021-07-22T19:05:57 Last Updated: 2024-08-03T19:56:11.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in SourceCodester Theme Park Ticketing System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to view_user.php . Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BigTiger2020/Theme-Park-Ticketing-System/blob/main/Theme%20Park%20Ticketing%20System.md
CVE ID: CVE-2021-25210 State: PUBLISHED Published: 2021-07-22T18:52:24 Last Updated: 2024-08-03T19:56:11.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arbitrary file upload vulnerability in SourceCodester Alumni Management System v 1.0 allows attackers to execute arbitrary code, via the file upload to manage_event.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BigTiger2020/Alumni-Management-System/blob/main/Alumni%20Management%20System-file%20upload.md
CVE ID: CVE-2021-25211 State: PUBLISHED Published: 2021-07-22T19:15:11 Last Updated: 2024-08-03T19:56:11.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arbitrary file upload vulnerability in SourceCodester Ordering System v 1.0 allows attackers to execute arbitrary code, via the file upload to ordering\admin\products\edit.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BigTiger2020/Ordering-System/blob/main/Ordering%20System.md
CVE ID: CVE-2021-25212 State: PUBLISHED Published: 2021-07-22T18:58:28 Last Updated: 2024-08-03T19:56:11.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in SourceCodester Alumni Management System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to manage_event.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BigTiger2020/Alumni-Management-System/blob/main/Alumni%20Management%20System-sql.md
CVE ID: CVE-2021-25213 State: PUBLISHED Published: 2021-07-22T19:08:28 Last Updated: 2024-08-03T19:56:11.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in SourceCodester Travel Management System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the catid parameter to subcat.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BigTiger2020/Travel-Management-System/blob/main/Travel%20Management%20System-sql.md
CVE ID: CVE-2021-25214 State: PUBLISHED Published: 2021-04-29T00:55:16.042608Z Last Updated: 2024-09-17T00:37:21.136Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND9 Problem Types: Incremental zone transfers (IXFR) provide a way of transferring changed portion(s) of a zone between servers. An IXFR stream containing SOA records with an owner name other than the transferred zone's apex may cause the receiving named server to inadvertently remove the SOA record for the zone in question from the zone database. This leads to an assertion failure when the next SOA refresh query for that zone is made. Affects BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.2
an assertion failure when the next SOA refresh query for that zone is made. Affects BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch. Description: In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the name
pment branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/v1/docs/cve-2021-25214 - http://www.openwall.com/lists/oss-security/2021/04/29/1 - http://www.openwall.com/lists/oss-security/2021/04/29/2 - http://www.openwall.com/lists/oss-security/2021/04/29/3 - http://www.openwall.com/lists/oss-security/2021/04/29/4 - https://www.debian.org/security/2021/dsa-4909 - https://lists.debian.org/debian-lts-announce/2021/05/msg00001.html - https://list
ww.debian.org/security/2021/dsa-4909 - https://lists.debian.org/debian-lts-announce/2021/05/msg00001.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VEC2XG4Q2ODTN2C4CGXEIXU3EUTBMK7L/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDSRPCJQ7MZC6CENH5PO3VQOFI7VSWBE/ - https://security.netapp.com/advisory/ntap-20210521-0006/ - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2021-25215 State: PUBLISHED Published: 2021-04-29T00:55:16.726513Z Last Updated: 2024-09-16T22:02:24.791Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND9 Problem Types: DNAME records, described in RFC 6672, provide a way to redirect a subtree of the domain name tree in the DNS. A flaw in the way named processes these records may trigger an attempt to add the same RRset to the ANSWER section more than once. This causes an assertion check in BIND to fail. DNAME records are processed by both authoritative and recursive servers. For authoritative servers, the DNAME record triggering the flaw can be retrieved from a zone database. Fo
rsive servers. For authoritative servers, the DNAME record triggering the flaw can be retrieved from a zone database. For servers performing recursion, such a record is processed in the course of a query sent to an authoritative server. Affects BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch. Description: In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 d
6.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record triggering the flaw described above, the named process will terminate due to a failed assertion check. The vulnerability affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other versions of BIND 9. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/v1/docs/cve-2021-25215 - http://www.openwall.com/lists/oss-security/2021/04/29/1 - http://www.openwall.com/lists/oss-security/2021/04/29/2 - http://www.openwall.com/l
om/lists/oss-security/2021/04/29/1 - http://www.openwall.com/lists/oss-security/2021/04/29/2 - http://www.openwall.com/lists/oss-security/2021/04/29/3 - http://www.openwall.com/lists/oss-security/2021/04/29/4 - https://www.debian.org/security/2021/dsa-4909 - https://lists.debian.org/debian-lts-announce/2021/05/msg00001.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VEC2XG4Q2ODTN2C4CGXEIXU3EUTBMK7L/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDSRPCJQ7MZC6CENH5PO3VQOFI7VSWBE/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://security.netapp.com/advisory/ntap-2021052
QOFI7VSWBE/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://security.netapp.com/advisory/ntap-20210521-0006/ - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2021-25216 State: PUBLISHED Published: 2021-04-29T00:55:17.362447Z Last Updated: 2024-09-16T22:25:23.581Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ISC Products: BIND9 Problem Types: GSS-TSIG is an extension to the TSIG protocol which is intended to support the secure exchange of keys for use in verifying the authenticity of communications between parties on a network. SPNEGO is a negotiation mechanism used by GSSAPI, the application protocol interface for GSS-TSIG. The SPNEGO implementation used by BIND has been found to be vulnerable to a buffer overflow attack. Affects BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -
vulnerable to a buffer overflow attack. Affects BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch. Description: In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch, BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulner
ed version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting values for the tkey-gssapi-keytab or tkey-gssapi-credential configuration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. For servers that meet these conditions, the ISC SPNEGO implementation is vulnerable to various attacks, depending on the CPU architecture for which BIND was built: F
SC SPNEGO implementation is vulnerable to various attacks, depending on the CPU architecture for which BIND was built: For named binaries compiled for 64-bit platforms, this flaw can be used to trigger a buffer over-read, leading to a server crash. For named binaries compiled for 32-bit platforms, this flaw can be used to trigger a server crash due to a buffer overflow and possibly also to achieve remote code execution. We have determined that standard SPNEGO implementations are available in the MIT and Heimdal Kerberos libraries, which support a broad range of operating systems, rendering the ISC implementation unnecessary and obsolete. Therefore, to reduce the attack surface for BIND users
stems, rendering the ISC implementation unnecessary and obsolete. Therefore, to reduce the attack surface for BIND users, we will be removing the ISC SPNEGO implementation in the April releases of BIND 9.11 and 9.16 (it had already been dropped from BIND 9.17). We would not normally remove something from a stable ESV (Extended Support Version) of BIND, but since system libraries can replace the ISC SPNEGO implementation, we have made an exception in this case for reasons of stability and security. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/v1/docs/cve-2021-25215 - http://www.openwall.com/lists/oss-security/2021/04/29/1 - http://www.openwall.com/lists/
sc.org/v1/docs/cve-2021-25215 - http://www.openwall.com/lists/oss-security/2021/04/29/1 - http://www.openwall.com/lists/oss-security/2021/04/29/2 - http://www.openwall.com/lists/oss-security/2021/04/29/3 - http://www.openwall.com/lists/oss-security/2021/04/29/4 - https://www.debian.org/security/2021/dsa-4909 - https://lists.debian.org/debian-lts-announce/2021/05/msg00001.html - https://security.netapp.com/advisory/ntap-20210521-0006/ - https://www.zerodayinitiative.com/advisories/ZDI-21-657/ - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2021-25217 State: PUBLISHED Published: 2021-05-26T22:10:11.312869Z Last Updated: 2024-09-16T22:08:32.175Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: ISC Products: ISC DHCP Problem Types: Program code used by the ISC DHCP package to read and parse stored leases has a defect that can be exploited by an attacker to cause one of several undesirable outcomes, depending on the component attacked and the way in which it was compiled. Because of a discrepancy between the code which handles encapsulated option information in leases transmitted "on the wire" and the code which reads and parses lease information after it has been written to disk storage,
ansmitted "on the wire" and the code which reads and parses lease information after it has been written to disk storage, it is potentially possible for an attacker to deliberately cause a situation where: dhcpd, while running in DHCPv4 or DHCPv6 mode, or dhclient, the ISC DHCP client implementation will attempt to read a stored lease that contains option information which will trigger a bug in the option parsing code. Affects ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2. Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the
he 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability. Affects both dhcpd (server) and dhcpcd (client). Description: In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability), The ou
t is also present in releases from those series, but they have not been officially tested for the vulnerability), The outcome of encountering the defect while reading a lease that will trigger it varies, according to: the component being affected (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced the error on a 64-bit system. However, on a 32-bit system it is possible to cause dhclient to crash when reading an improper lease, which could cause network connectivity problems for an affected system due to the absence of a running DHCP cli
r lease, which could cause network connectivity problems for an affected system due to the absence of a running DHCP client process. In dhcpd, when run in DHCPv4 or DHCPv6 mode: if the dhcpd server binary was built for a 32-bit architecture AND the -fstack-protection-strong flag was specified to the compiler, dhcpd may exit while parsing a lease file containing an objectionable lease, resulting in lack of service to clients. Additionally, the offending lease and the lease immediately following it in the lease database may be improperly deleted. if the dhcpd server binary was built for a 64-bit architecture OR if the -fstack-protection-strong compiler flag was NOT specified, the crash will no
s built for a 64-bit architecture OR if the -fstack-protection-strong compiler flag was NOT specified, the crash will not occur, but it is possible for the offending lease and the lease which immediately followed it to be improperly deleted. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2021-25217 - http://www.openwall.com/lists/oss-security/2021/05/26/6 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LB42JWIV4M4WDNXX5VGIP26FEYWKIF/ - https://lists.debian.org/debian-lts-announce/2021/06/msg00002.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/mes
nce/2021/06/msg00002.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QI4DYC7J4BGHEW3NH4XHMWTHYC36UK4/ - https://cert-portal.siemens.com/productcert/pdf/ssa-406691.pdf - https://security.netapp.com/advisory/ntap-20220325-0011/ - https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf - https://security.gentoo.org/glsa/202305-22
CVE ID: CVE-2021-25218 State: PUBLISHED Published: 2021-08-18T18:20:11.962739Z Last Updated: 2024-09-17T03:07:43.591Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND9 Problem Types: If named attempts to respond over UDP with a response that is larger than the current effective interface maximum transmission unit (MTU), and if response-rate limiting (RRL) is active, an assertion failure is triggered (resulting in termination of the named server process). There are two ways for named to exceed the interface MTU: Direct configuration in named.conf setting max-udp-size to a value larger than the interface's MTU, or Path MTU discovery (PMTUD) inf
uration in named.conf setting max-udp-size to a value larger than the interface's MTU, or Path MTU discovery (PMTUD) informing the IP stack that it should use a smaller MTU for the interface and destination than the default max-udp-size value of 1232. Some operating systems allow packets received via other protocols to affect PMTUD values for DNS over UDP. While RRL is not enabled by default for user-defined views or the built-in default INTERNET (IN) class view, "_default", the built-in default CHAOS (CH) class view, "_bind", does have RRL enabled. Note that while this defect can be triggered through misconfiguration or by deliberate exploitation, it can also arise during normal operating c
ect can be triggered through misconfiguration or by deliberate exploitation, it can also arise during normal operating conditions, even with hardened PMTUD settings. Affects BIND 9.16.19, 9.17.16. Also, version 9.16.19-S1 of BIND Supported Preview Edition. Description: In BIND 9.16.19, 9.17.16. Also, version 9.16.19-S1 of BIND Supported Preview Edition When a vulnerable version of named receives a query under the circumstances described above, the named process will terminate due to a failed assertion check. The vulnerability affects only BIND 9 releases 9.16.19, 9.17.16, and release 9.16.19-S1 of the BIND Supported Preview Edition. Additional Analyst Notes: - CVE Program Container: Referenc
nd release 9.16.19-S1 of the BIND Supported Preview Edition. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/v1/docs/cve-2021-25218 - http://www.openwall.com/lists/oss-security/2021/08/18/3 - http://www.openwall.com/lists/oss-security/2021/08/20/2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZPJCLGSR4BTGFLBLGIE5TEQP2SNJKGVL/ - https://security.netapp.com/advisory/ntap-20210909-0002/
CVE ID: CVE-2021-25219 State: PUBLISHED Published: 2021-10-27T21:10:10.088929Z Last Updated: 2024-09-16T17:33:38.865Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: ISC Products: BIND9 Problem Types: Authoritative-only BIND 9 servers are NOT vulnerable to this flaw. The purpose of a resolver's lame cache is to ensure that if an authoritative server responds to a resolver's query in a specific broken way, subsequent client queries for the same <QNAME, QTYPE> tuple do not trigger further queries to the same server for a configurable amount of time. The lame cache is enabled by setting the "lame-ttl" option in named.conf to a value greater than 0. That option
f time. The lame cache is enabled by setting the "lame-ttl" option in named.conf to a value greater than 0. That option is set to "lame-ttl 600;" in the default configuration, which means the lame cache is enabled by default. A successful attack exploiting this flaw causes a named resolver to spend most of its CPU time on managing and checking the lame cache. This results in client queries being responded to with large delays, and increased likelihood of DNS timeouts on client hosts. Affects BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17