GitHub Advisoryadvisory · Go

GHSA-jr65-gpj5-cw74 go-resolver's DNSSEC validation not performed correctly

HIGH Published 2022-12-28 Modified 2022-12-29 Official page ↗
Aliases
CVE-2022-3347
Ecosystem
Go
Packages
github.com/peterzen/goresolver
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-345, CWE-347
Reviewed
2022-12-29

Affected packages

• Go github.com/peterzen/goresolver: <= 1.0.2 (no fix yet)

Description

go-resolver's DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. Root DNSSEC public keys are not validated, permitting an attacker to present a self-signed root key and delegation chain.

Related

Alias · CVE (1)

  • CVE-2022-3347 DNSSEC validation is not performed correctly. vulnerability

Weakness · CWE (2)

  • CWE-345 Insufficient Verification of Data Authenticity weakness
  • CWE-347 Improper Verification of Cryptographic Signature weakness

References