Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tbXd4LXJqODctdmZncs4AA-E2

DNSJava affected by KeyTrap - NSEC3 closest encloser proof can exhaust CPU resources

Impact

Users using the ValidatingResolver for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.

Patches

Users should upgrade to dnsjava v3.6.0

Workarounds

Although not recommended, only using a non-validating resolver, will remove the vulnerability.

References

https://www.athene-center.de/en/keytrap

Permalink: https://github.com/advisories/GHSA-mmwx-rj87-vfgr
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tbXd4LXJqODctdmZncs4AA-E2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 months ago
Updated: 3 days ago

CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Identifiers: GHSA-mmwx-rj87-vfgr
References:

• https://github.com/dnsjava/dnsjava/security/advisories/GHSA-mmwx-rj87-vfgr
• https://github.com/dnsjava/dnsjava/commit/711af79be3214f52daa5c846b95766dc0a075116
• https://nvd.nist.gov/vuln/detail/CVE-2023-50868
• https://github.com/advisories/GHSA-pv4h-p8jr-6cv2
• https://github.com/advisories/GHSA-mmwx-rj87-vfgr

Repository: https://github.com/dnsjava/dnsjava
Blast Radius: 22.2

Affected Packages