Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1jcmpnLXc1N20tcnFxZs4AA-FL

DNSJava vulnerable to KeyTrap - Denial-of-Service Algorithmic Complexity Attacks

Impact

Users using the ValidatingResolver for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.

Patches

Users should upgrade to dnsjava v3.6.0

Workarounds

Although not recommended, only using a non-validating resolver, will remove the vulnerability.

References

https://www.athene-center.de/en/keytrap

Permalink: https://github.com/advisories/GHSA-crjg-w57m-rqqf
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jcmpnLXc1N20tcnFxZs4AA-FL
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 months ago
Updated: 3 days ago

CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Identifiers: GHSA-crjg-w57m-rqqf
References:

• https://github.com/dnsjava/dnsjava/security/advisories/GHSA-crjg-w57m-rqqf
• https://github.com/dnsjava/dnsjava/commit/07ac36a11578cc1bce0cd8ddf2fe568f062aee78
• https://github.com/dnsjava/dnsjava/commit/3ddc45ce8cdb5c2274e10b7401416f497694e1cf
• https://nvd.nist.gov/vuln/detail/CVE-2023-50387
• https://github.com/advisories/GHSA-8459-gg55-8qjj
• https://github.com/advisories/GHSA-crjg-w57m-rqqf

Repository: https://github.com/dnsjava/dnsjava
Blast Radius: 22.2

Affected Packages