Описание
The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.
A flaw was found in pdns-recursor. This vulnerability allows a remote attacker to bypass DNSSEC (Domain Name System Security Extensions) validation. The flaw occurs because the system accepts wildcard expansion proofs (NSEC/NSEC3 records) without proper signature validation when the wildcard answer is a CNAME (Canonical Name) or DNAME (Delegation Name) record. This can lead to an attacker providing forged DNS responses, potentially resulting in information integrity issues.
Отчет
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the affected packages, refer to the linked references.
Дополнительная информация
Статус:
EPSS
3.7 Low
CVSS3
Связанные уязвимости
The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.
The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.
The issue is a DNSSEC validation bypass where wildcard expansion proof ...
The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.
EPSS
3.7 Low
CVSS3