CVE-2023-50868

Опубликовано: 14 фев. 2024

Источник: nvd

CVSS3: 7.5

EPSS Средний

Описание

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

Ссылки

http://www.openwall.com/lists/oss-security/2024/02/16/2
Issue Tracking
Mailing List
http://www.openwall.com/lists/oss-security/2024/02/16/3
Issue Tracking
Mailing List
https://access.redhat.com/security/cve/CVE-2023-50868
Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1219826
Issue Tracking
https://datatracker.ietf.org/doc/html/rfc5155
Technical Description
https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html
Vendor Advisory
https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1
Release Notes
https://kb.isc.org/docs/cve-2023-50868
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html
Vendor Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2024/05/msg00011.html
Vendor Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/
Vendor Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/
Vendor Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/
Vendor Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/
Vendor Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/
Vendor Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/
Vendor Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/
Vendor Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/
Vendor Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/
Vendor Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/
Vendor Advisory
Mailing List

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*

Версия от 9.0.0 (включая) до 9.16.48 (исключая)

cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*

Версия от 9.9.3 (включая) до 9.16.48 (исключая)

cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*

Версия от 9.18.0 (включая) до 9.18.24 (исключая)

cpe:2.3:a:isc:bind:*:s1:*:*:supported_preview:*:*:*

Версия от 9.18.11 (включая) до 9.18.24 (исключая)

cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*

Версия от 9.19.0 (включая) до 9.19.21 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.4:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*

Версия до 4.8.5 (исключая)

cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*

Версия от 4.9.0 (включая) до 4.9.3 (исключая)

cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*

Версия от 5.0.0 (включая) до 5.0.2 (исключая)

Конфигурация 6

Одновременно

cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Конфигурация 7

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*

Конфигурация 8

Одновременно

cpe:2.3:a:netapp:hci_baseboard_management_controller:-:*:*:*:*:*:*:*

Одно из

cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

EPSS

Процентиль: 94%

0.13771

Средний

7.5 High

CVSS3

7.5 High

CVSS3

Дефекты

CWE-400

Связанные уязвимости

CVE-2023-50868

CVSS3: 7.5

ubuntu

почти 2 года назад

CVE-2023-50868

CVSS3: 7.5

redhat

почти 2 года назад

CVE-2023-50868

CVSS3: 7.5

msrc

больше 1 года назад

MITRE: CVE-2023-50868 NSEC3 closest encloser proof can exhaust CPU

CVE-2023-50868

CVSS3: 7.5

debian

почти 2 года назад

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 whe ...

GHSA-pv4h-p8jr-6cv2

CVSS3: 7.5

github

почти 2 года назад

EPSS

Процентиль: 94%

0.13771

Средний

7.5 High

CVSS3

7.5 High

CVSS3

Дефекты

CWE-400