CVE-2023-50387
14.02.2024, 16:15
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.Enginsight
| Vendor | Product | Version |
|---|---|---|
| redhat | enterprise_linux | 6.0 |
| redhat | enterprise_linux | 7.0 |
| redhat | enterprise_linux | 8.0 |
| redhat | enterprise_linux | 9.0 |
| microsoft | windows_server_2012 | - |
| microsoft | windows_server_2016 | - |
| microsoft | windows_server_2019 | - |
| microsoft | windows_server_2022 | - |
| microsoft | windows_server_2022_23h2 | - |
| thekelleys | dnsmasq | 𝑥 < 2.90 |
| nic | knot_resolver | 𝑥 < 5.71 |
| powerdns | recursor | 4.8.0 ≤ 𝑥 < 4.8.6 |
| powerdns | recursor | 4.9.0 ≤ 𝑥 < 4.9.3 |
| powerdns | recursor | 5.0.0 ≤ 𝑥 < 5.0.2 |
| isc | bind | 9.0.0 ≤ 𝑥 ≤ 9.16.46 |
| isc | bind | 9.18.0 ≤ 𝑥 ≤ 9.18.22 |
| isc | bind | 9.19.0 ≤ 𝑥 ≤ 9.19.20 |
| nlnetlabs | unbound | 𝑥 < 1.19.1 |
𝑥
= Vulnerable software versions
Debian Releases
Debian Product | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| bind9 |
| ||||||||||||||
| dnsjava |
| ||||||||||||||
| dnsmasq |
| ||||||||||||||
| knot-resolver |
| ||||||||||||||
| pdns-recursor |
| ||||||||||||||
| systemd |
| ||||||||||||||
| unbound |
|
Ubuntu Releases
Ubuntu Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| bind9 |
| ||||||||||||||||
| bind9-libs |
| ||||||||||||||||
| dnsmasq |
| ||||||||||||||||
| isc-dhcp |
| ||||||||||||||||
| knot-resolver |
| ||||||||||||||||
| pdns-recursor |
| ||||||||||||||||
| unbound |
|
References