CVE-2023-50868

Published Feb 14, 2024

Last updated 4 months ago

CVSS high 7.5
Dns
Port (53)

Overview

Description
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
Source
cve@mitre.org
NVD status
Analyzed
Products
bind, fedora, debian_linux, enterprise_linux, recursor, bootstrap_os, active_iq_unified_manager, hci_baseboard_management_controller

Risk scores

CVSS 3.1

Type
Primary
Base score
7.5
Impact score
3.6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity
HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-400

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.