CVE-2023-50868
EUVD-2023-5560114.02.2024, 16:15
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| isc | bind | 9.0.0 ≤ 𝑥 < 9.16.48 |
| isc | bind | 9.9.3 ≤ 𝑥 < 9.16.48 |
| isc | bind | 9.18.0 ≤ 𝑥 < 9.18.24 |
| isc | bind | 9.18.11 ≤ 𝑥 < 9.18.24 |
| isc | bind | 9.19.0 ≤ 𝑥 < 9.19.21 |
| debian | debian_linux | 10.0 |
| debian | debian_linux | 11.0 |
| redhat | enterprise_linux | 6.0 |
| redhat | enterprise_linux | 7.0 |
| redhat | enterprise_linux | 8.0 |
| redhat | enterprise_linux | 8.2 |
| redhat | enterprise_linux | 8.4 |
| powerdns | recursor | 𝑥 < 4.8.5 |
| powerdns | recursor | 4.9.0 ≤ 𝑥 < 4.9.3 |
| powerdns | recursor | 5.0.0 ≤ 𝑥 < 5.0.2 |
| netapp | bootstrap_os | - |
| netapp | active_iq_unified_manager | - |
| netapp | hci_baseboard_management_controller | - |
𝑥
= Vulnerable software versions
Windows Releases
Platform | Version | ||||||
|---|---|---|---|---|---|---|---|
| Windows Server 2012 |
| ||||||
| Windows Server 2012 R2 |
| ||||||
| Windows Server 2016 |
| ||||||
| Windows Server 2019 |
| ||||||
| Windows Server 2022 |
|
Debian Releases
Debian Product | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| bind9 |
| ||||||||||||||
| dnsjava |
| ||||||||||||||
| dnsmasq |
| ||||||||||||||
| knot-resolver |
| ||||||||||||||
| pdns-recursor |
| ||||||||||||||
| systemd |
| ||||||||||||||
| unbound |
|
Ubuntu Releases
Ubuntu Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| bind9 |
| ||||||||||||||||
| bind9-libs |
| ||||||||||||||||
| dnsmasq |
| ||||||||||||||||
| isc-dhcp |
| ||||||||||||||||
| knot-resolver |
| ||||||||||||||||
| pdns-recursor |
| ||||||||||||||||
| unbound |
|
References