In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND
9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1:
Unless a nameserver is providing authoritative service for one or more
zones and at least one zone contains an empty non-terminal entry containing
an asterisk ("*") character, this defect cannot be encountered. A would-be
attacker who is allowed to change zone content could theoretically
introduce such a record in order to exploit this condition to cause denial
of service, though we consider the use of this vector unlikely because any
such attack would require a significant privilege level and be easily
mdeslaurupstream advisory says BIND 9.11.14 -> 9.11.19, probably
introduced in race condition fixes introduced in 9.11.4.
Source: bind9 (LP Ubuntu Debian)
Upstream:released (9.11.20,9.16.4)
Ubuntu 12.04 ESM (Precise Pangolin):not-affected
Ubuntu 14.04 ESM (Trusty Tahr):not-affected
Ubuntu 16.04 LTS (Xenial Xerus):not-affected (1:9.10.3.dfsg.P4-8ubuntu1.16)
Ubuntu 18.04 LTS (Bionic Beaver):not-affected (1:9.11.3+dfsg-1ubuntu1.12)
Ubuntu 19.10 (Eoan Ermine):not-affected (1:9.11.5.P4+dfsg-5.1ubuntu2.2)
Ubuntu 20.04 LTS (Focal Fossa):released (1:9.16.1-0ubuntu2.2)
Ubuntu 20.10 (Groovy Gorilla):released (1:9.16.3-1ubuntu2)
More Information

Updated: 2020-07-01 14:28:44 UTC (commit f2a40e02a46fe0d2c9d7b8b97047199f18432424)