Описание
The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.
A flaw was found in nsd. A remote attacker can bypass BLOCKED access control list (ACL) items on the proxy protocol port. This bypass occurs when connecting over TCP or TLS and sending the query twice on a persistent connection. This could allow unauthorized access or actions that should have been prevented by the ACL.
Отчет
This vulnerability is rated as an Important impact because an unauthenticated remote client can circumvent configured ACL boundaries to access restricted DNS zones without authorization. Red Hat Enterprise Linux does not ship NSD in its core repositories, restricting the potential blast radius to community builds such as Fedora and EPEL. Furthermore, exploitation requires deployments to explicitly configure a proxy protocol port and accept persistent TCP or TLS connections.
Меры по смягчению последствий
To mitigate this issue, disable the proxy protocol feature in the nsd configuration if it is not required. This can typically be done by removing or commenting out proxy protocol related directives in the nsd.conf file. A restart of the nsd service will be required for the changes to take effect and may impact DNS resolution during the restart.
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.
The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.
The BLOCKED access control list items that are evaluated to deny acces ...
The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.
ALT-PU-2026-14204: package `nsd` update to version 4.15.1-alt1
EPSS
7.5 High
CVSS3