GitHub Advisoryadvisory · PyPI

GHSA-m6h2-634h-jcpj Designate mDNS DoS through incorrect handling of large RecordSets

HIGH Published 2022-05-17 Modified 2024-11-26 Official page ↗
Aliases
CVE-2015-5695
Ecosystem
PyPI
Packages
designate
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2024-11-21

Affected packages

• PyPI designate: 2015.1.0b2 (no fix yet)

Description

Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas when processing an internal zone file transfer, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted resource record set.

Related

Alias · CVE (1)

  • CVE-2015-5695 Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References