CVEvulnerability

CVE-2023-50387

7.5 HIGH Published 2024-02-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-02-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770

Description

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Affected configurations

• redhat enterprise linux 6.0 • redhat enterprise linux 7.0 • redhat enterprise linux 8.0 • redhat enterprise linux 9.0 • microsoft windows server 2008 r2 • microsoft windows server 2012 • microsoft windows server 2012 r2 • microsoft windows server 2016 • microsoft windows server 2019 • microsoft windows server 2022 • microsoft windows server 2022 23h2 • fedoraproject fedora 39 • thekelleys dnsmasq (< 2.90) • nic knot resolver (< 5.71) • powerdns recursor (>= 4.8.0 < 4.8.6) • powerdns recursor (>= 4.9.0 < 4.9.3) • powerdns recursor (>= 5.0.0 < 5.0.2) • isc bind (>= 9.0.0 <= 9.16.46) • isc bind (>= 9.18.0 <= 9.18.22) • isc bind (>= 9.19.0 <= 9.19.20) • nlnetlabs unbound (< 1.19.1)

Related

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References