CVE-2023-50387
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU...
Original description
The description as published by the source.
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2023-50387 bind Fixed in: 9.16.48-r0
- Debian DEBIAN-CVE-2023-50387 bind9 Fixed in: 1:9.16.48-1
- Ubuntu UBUNTU-CVE-2023-50387 bind9 Fixed in: 1:9.9.5.dfsg-3ubuntu0.19+esm12
References
- advisory docs.powerdns.com
- advisory github.com
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory security.netapp.com
- report bugzilla.suse.com
- web access.redhat.com
- web gitlab.nic.cz
- web kb.isc.org
- web lists.debian.org
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.thekelleys.org.uk
- web msrc.microsoft.com
- web news.ycombinator.com
- web news.ycombinator.com
- web nlnetlabs.nl
- web athene-center.de
- web athene-center.de
- web securityweek.com
- web theregister.com
- web openwall.com
- web openwall.com
- web lists.debian.org
- web lists.debian.org
- web isc.org