Which products and versions are affected by CVE-2020-8625?

Affected: Bind (Isc) versions 9.11.21-s1, 9.11.27-s1, 9.11.3-s1, 9.11.5-s3, 9.11.5-s5, 9.11.6-s1, 9.11.7-s1, 9.11.8-s1; Cloud Backup (Netapp); Sinec Infrastructure Network Services (Siemens), among others. The full list is in the CVE brief.

Is CVE-2020-8625 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2020-8625 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2020-8625?

No public exploit code is known.

Is there a fix for CVE-2020-8625?

Fixed versions are available, including Bind 32:9.11.13-6.el8_2.2, Bind 32:9.11.20-5.el8_3.1, Bind 32:9.11.4-26.P2.amzn2.4.

How urgently should CVE-2020-8625 be patched?

Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Request A Demo

Vulnerability Intelligence

CVE-2020-8625

High

BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features.

Published Mar 11, 2022 · Updated Aug 7, 2026 · Also known as ALPINE-CVE-2020-8625, DEBIAN-CVE-2020-8625, DLA-2568-1, DSA-4857-1, SUSE-SU-2021:0503-1, SUSE-SU-2021:0504-1, SUSE-SU-2021:0507-1, SUSE-SU-2021:14632-1, UBUNTU-CVE-2020-8625, USN-4737-1, USN-4737-2

Key Facts

Patch immediately

CVE-2020-8625 is a high-severity vulnerability (CVSS 8.1 v3.1) affecting Bind (Isc), Cloud Backup (Netapp), Sinec Infrastructure Network Services (Siemens) and 22 more products.
It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
EPSS estimates a 64% probability of exploitation in the next 30 days.
Fixed versions are available, including Bind 32:9.11.13-6.el8_2.2, Bind 32:9.11.20-5.el8_3.1, Bind 32:9.11.4-26.P2.amzn2.4.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

8.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

64%

Higher than 99.2% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2020-8625 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch

Affected Products

533 affected entries in total

Product	Affected versions	Fixed in
BindIsc	9.11.21-s1, 9.11.27-s1, 9.11.3-s1, 9.11.5-s3, 9.11.5-s5, 9.11.6-s1, 9.11.7-s1, 9.11.8-s1	9.11.27
Cloud BackupNetapp	See advisory	n/a
Sinec Infrastructure Network ServicesSiemens	See advisory	1.0.1.1
Debian LinuxDebian	10.0, 9.0	n/a
FedoraFedoraproject	32, 33, 34	n/a

20 more affected products in the full CVE brief

Patched Releases

Bind

32:9.11.13-6.el8_2.2, 32:9.11.20-5.el8_3.1, 32:9.11.4-26.P2.amzn2.4, 32:9.11.4-26.P2.el7_9.4, 32:9.8.2-0.68.rc1.0.1.el6_10.8, 32:9.8.2-0.68.rc1.86.amzn1, 32:9.8.2-0.68.rc1.el6_10.10, 32:9.9.4-29.el7_2.10, 9.11.22-3.29.1, 9.16.11-r2, 9.16.12-1, 9.16.20-1.4, 9.16.3-3, 9.16.6-12.41.1, 9.16.6-lp152.14.12.1, 9.9.6P1-0.51.23.1, 9.9.9P1-63.20.1, <=9.11.27

bind-chroot

32:9.11.20-5.el8_3.1, 32:9.11.4-26.P2.amzn2.4, 32:9.11.4-26.P2.el7_9.4, 32:9.8.2-0.68.rc1.0.1.el6_10.8, 32:9.8.2-0.68.rc1.86.amzn1

bind-chrootenv

9.11.22-3.29.1, 9.16.6-12.41.1, 9.16.6-lp152.14.12.1, 9.9.6P1-0.51.23.1, 9.9.9P1-63.20.1

bind-devel

32:9.11.20-5.el8_3.1, 32:9.11.4-26.P2.amzn2.4, 32:9.11.4-26.P2.el7_9.4, 32:9.8.2-0.68.rc1.0.1.el6_10.8, 32:9.8.2-0.68.rc1.86.amzn1, 9.11.22-3.29.1, 9.16.6-12.41.1, 9.16.6-lp152.14.12.1, 9.9.6P1-0.51.23.1

bind-devel-32bit

9.16.6-lp152.14.12.1

bind-doc

9.11.22-3.29.1, 9.16.20-1.4, 9.16.6-12.41.1, 9.16.6-lp152.14.12.1, 9.9.6P1-0.51.23.1, 9.9.9P1-63.20.1

bind-export-devel