CVE-2023-50387
High
Description
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Redhat Enterprise Linux
PublishedFeb 14, 2024
First seenFeb 14, 2024
Weakness typeCWE-770Allocation of resources without limits
How to fix
Update
- thekelleys dnsmasq2.90 or later
- nic knot_resolver5.71 or later
- powerdns recursor4.8.6, 4.9.3, 5.0.2 or later
- nlnetlabs unbound1.19.1 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise_linux | 6.0, 7.0, 8.0, 9.0 | — |
| microsoft windows_server_2008 | r2 | — |
| microsoft windows_server_2012 | No range specified, r2 | — |
| microsoft windows_server_2016 | No range specified | — |
| microsoft windows_server_2019 | No range specified | — |
| microsoft windows_server_2022 | No range specified | — |
| microsoft windows_server_2022_23h2 | No range specified | — |
| fedoraproject fedora | 39 | — |
| thekelleys dnsmasq | v < 2.90 | 2.90 |
| nic knot_resolver | v < 5.71 | 5.71 |
| powerdns recursor | 4.8.0 ≤ v < 4.8.6, 4.9.0 ≤ v < 4.9.3, 5.0.0 ≤ v < 5.0.2 | 4.8.6, 4.9.3, 5.0.2 |
| isc bind | 9.0.0 ≤ v ≤ 9.16.46, 9.18.0 ≤ v ≤ 9.18.22, 9.19.0 ≤ v ≤ 9.19.20 | — |
| nlnetlabs unbound | v < 1.19.1 | 1.19.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.