CVE-2023-50387

Published Feb 14, 2024

Last updated 6 months ago

CVSS high 7.5
Dns
Port (53)

Overview

Description
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
Source
cve@mitre.org
NVD status
Modified
Products
enterprise_linux, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022, windows_server_2022_23h2, fedora, dnsmasq, knot_resolver, recursor, bind, unbound

Risk scores

CVSS 3.1

Type
Primary
Base score
7.5
Impact score
3.6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity
HIGH

Weaknesses

nvd@nist.gov
CWE-770
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-770

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.