Описание
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
A flaw was found in golang.org/x/net/dns/dnsmessage. A remote attacker could send a specially crafted Service Binding (SVCB) or HTTPS resource record (RR) to a system using this component. When parsing this invalid record, the system may panic due to a parameter value overflowing the message buffer. This can lead to a Denial of Service (DoS) condition, making the affected system unavailable.
Отчет
Red Hat has rated this vulnerability as Important because an unauthenticated network adversary can trigger an immediate denial of service across core Go-based services without prior authorization. Within Red Hat OpenShift and hybrid cloud management platforms, multiple microservices and controllers depend on Go networking routines for background domain resolution. Receiving a DNS response configured with malformed Service Binding or HTTPS data triggers an unhandled parsing panic, abruptly stopping dependent controller processes and degrading cluster availability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| ExternalDNS Operator | edo/external-dns-rhel9 | Affected | ||
| ExternalDNS Operator | edo/external-dns-rhel9-operator | Affected | ||
| File Integrity Operator | compliance/openshift-compliance-rhel8-operator | Not affected | ||
| File Integrity Operator | compliance/openshift-file-integrity-rhel8-operator | Affected | ||
| Multicluster Engine for Kubernetes | multicluster-engine/addon-manager-rhel9 | Affected | ||
| Multicluster Engine for Kubernetes | multicluster-engine/assisted-installer-agent-rhel9 | Affected | ||
| Multicluster Engine for Kubernetes | multicluster-engine/assisted-installer-controller-rhel9 | Affected | ||
| Multicluster Engine for Kubernetes | multicluster-engine/assisted-installer-rhel9 | Affected | ||
| Multicluster Engine for Kubernetes | multicluster-engine/assisted-service-9-rhel9 | Affected | ||
| Multicluster Engine for Kubernetes | multicluster-engine/backplane-rhel9-operator | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Parsing an invalid SVCB or HTTPS RR can panic when the size of a param ...
EPSS
7.5 High
CVSS3