CVE-2023-50387
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Alpine Linux ALPINE-CVE-2023-50387 bind 修正版: 9.16.48-r0
- Debian DEBIAN-CVE-2023-50387 bind9 修正版: 1:9.16.48-1
- Ubuntu UBUNTU-CVE-2023-50387 bind9 修正版: 1:9.9.5.dfsg-3ubuntu0.19+esm12
参照URL
- advisory docs.powerdns.com
- advisory github.com
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory security.netapp.com
- report bugzilla.suse.com
- web access.redhat.com
- web gitlab.nic.cz
- web kb.isc.org
- web lists.debian.org
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.thekelleys.org.uk
- web msrc.microsoft.com
- web news.ycombinator.com
- web news.ycombinator.com
- web nlnetlabs.nl
- web athene-center.de
- web athene-center.de
- web securityweek.com
- web theregister.com
- web openwall.com
- web openwall.com
- web lists.debian.org
- web lists.debian.org
- web isc.org