CVE - CVE-2023-50387

CVE-ID
CVE-2023-50387	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://security.netapp.com/advisory/ntap-20240307-0007/ FEDORA:FEDORA-2024-21310568fa URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/ FEDORA:FEDORA-2024-2e26eccfcb URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/ FEDORA:FEDORA-2024-499b9be35f URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/ FEDORA:FEDORA-2024-4e36df9dfd URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/ FEDORA:FEDORA-2024-b0f9656a76 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/ FEDORA:FEDORA-2024-c36c448396 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/ FEDORA:FEDORA-2024-c967c7d287 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/ FEDORA:FEDORA-2024-e00eceb11c URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/ FEDORA:FEDORA-2024-e24211eff0 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/ FEDORA:FEDORA-2024-fae88b73eb URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/ MISC:https://access.redhat.com/security/cve/CVE-2023-50387 MISC:https://bugzilla.suse.com/show_bug.cgi?id=1219823 MISC:https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html MISC:https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 MISC:https://kb.isc.org/docs/cve-2023-50387 MISC:https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html MISC:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-50387 MISC:https://news.ycombinator.com/item?id=39367411 MISC:https://news.ycombinator.com/item?id=39372384 MISC:https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ MISC:https://www.athene-center.de/aktuelles/key-trap MISC:https://www.athene-center.de/fileadmin/content/PDF/Technical_Report_KeyTrap.pdf MISC:https://www.isc.org/blogs/2024-bind-security-release/ MISC:https://www.securityweek.com/keytrap-dns-attack-could-disable-large-parts-of-internet-researchers/ MISC:https://www.theregister.com/2024/02/13/dnssec_vulnerability_internet/ MLIST:[debian-lts-announce] 20240221 [SECURITY] [DLA 3736-1] unbound security update URL:https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html MLIST:[oss-security] 20240216 Re: Unbound: disclosure of CVE-2023-50387 and CVE-2023-50868 DNSSEC validation vulnerabilities URL:http://www.openwall.com/lists/oss-security/2024/02/16/2 MLIST:[oss-security] 20240216 Re: Unbound: disclosure of CVE-2023-50387 and CVE-2023-50868 DNSSEC validation vulnerabilities URL:http://www.openwall.com/lists/oss-security/2024/02/16/3
Assigning CNA
MITRE Corporation
Date Record Created
20231207	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20231207)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)