CVE-2023-50868
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of ser...
Original description
The description as published by the source.
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2023-50868 bind Fixed in: 9.16.48-r0
- Debian DEBIAN-CVE-2023-50868 bind9 Fixed in: 1:9.16.48-1
- Ubuntu UBUNTU-CVE-2023-50868 bind9 Fixed in: 1:9.9.5.dfsg-3ubuntu0.19+esm12
References
- advisory docs.powerdns.com
- advisory github.com
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory security.netapp.com
- report bugzilla.suse.com
- web access.redhat.com
- web datatracker.ietf.org
- web gitlab.nic.cz
- web kb.isc.org
- web lists.debian.org
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.thekelleys.org.uk
- web nlnetlabs.nl
- web openwall.com
- web openwall.com
- web lists.debian.org
- web lists.debian.org
- web isc.org