GitHub Advisoryadvisory · Go

GHSA-87mm-qxm5-cp3f go-resolver vulnerable to attacker-controlled domains due to unvalidated RRSIG RRs

HIGH Published 2022-12-28 Modified 2022-12-29 Official page ↗
Aliases
CVE-2022-3346
Ecosystem
Go
Packages
github.com/peterzen/goresolver
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-345
Reviewed
2022-12-29

Affected packages

• Go github.com/peterzen/goresolver: <= 1.0.2 (no fix yet)

Description

go-resolver's DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The owner name of RRSIG RRs is not validated, permitting an attacker to present the RRSIG for an attacker-controlled domain in a response for any other domain.

Related

Alias · CVE (1)

  • CVE-2022-3346 DNSSEC validation is not performed correctly. vulnerability

Weakness · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

References