This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-10190 →

DEBIAN-CVE-2019-10190

A vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers to bypass D...

Original description

The description as published by the source.

A vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers to bypass DNSSEC validation for non-existence answer. NXDOMAIN answer would get passed through to the client even if its DNSSEC validation failed, instead of sending a SERVFAIL packet. Caching is not affected by this particular bug but see CVE-2019-10191.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 knot-resolver

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-1"}]}]

Debian:13 knot-resolver

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-1"}]}]

Debian:14 knot-resolver

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-1"}]}]

References

advisory security-tracker.debian.org