CVE-2023-50868
High
Description
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Netapp Hci Baseboard Management Controller
PublishedFeb 14, 2024
First seenFeb 14, 2024
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- powerdns recursor4.8.5, 4.9.3, 5.0.2 or later
- isc bind9.16.48, 9.18.24, 9.19.21 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netapp hci_baseboard_management_controller | No range specified | — |
| netapp active_iq_unified_manager | No range specified | — |
| netapp bootstrap_os | No range specified | — |
| powerdns recursor | v < 4.8.5, 4.9.0 ≤ v < 4.9.3, 5.0.0 ≤ v < 5.0.2 | 4.8.5, 4.9.3, 5.0.2 |
| redhat enterprise_linux | 6.0, 7.0, 8.0, 8.2, 8.4 | — |
| debian debian_linux | 10.0, 11.0 | — |
| fedoraproject fedora | 38, 39 | — |
| isc bind | 9.0.0 ≤ v < 9.16.48, 9.9.3 ≤ v < 9.16.48, 9.18.0 ≤ v < 9.18.24, 9.18.11 ≤ v < 9.18.24, 9.19.0 ≤ v < 9.19.21 | 9.16.48, 9.18.24, 9.19.21 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.