CVE-2023-50387
CVE-2023-50387
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
CVSS 7.5 · High · EPSS 100.0% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
bind9 Debian:12
- Versions
- 1:9.18.12-1
- 1:9.18.13-1
- 1:9.18.16-1
- 1:9.18.16-1~deb12u1
- 1:9.18.16-1~deb12u1~bpo11+1
- 1:9.18.19-1~deb12u1
- 1:9.18.19-1~deb12u1~bpo11+1
- 1:9.18.24-1~bpo11+1
- Affected ranges
- ECOSYSTEM: < 1:9.18.24-1
Update to 1:9.18.24-1
bind9 Debian:13
- Affected ranges
- ECOSYSTEM: < 1:9.19.21-1
Update to 1:9.19.21-1
bind9 Debian:14
- Affected ranges
- ECOSYSTEM: < 1:9.19.21-1
Update to 1:9.19.21-1
dnsjava Debian:12
- Versions
- 2.1.8-2
- 3.6.2-1
- 3.6.2-2
- 3.6.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dnsjava Debian:13
- Affected ranges
- ECOSYSTEM: < 3.6.2-1
Update to 3.6.2-1
dnsjava Debian:14
- Affected ranges
- ECOSYSTEM: < 3.6.2-1
Update to 3.6.2-1
dnsmasq Debian:12
- Versions
- 2.89-1
- 2.90-1
- 2.90-2
- 2.90-3
- Affected ranges
- ECOSYSTEM: < 2.90-4~deb12u1
Update to 2.90-4~deb12u1
dnsmasq Debian:13
- Affected ranges
- ECOSYSTEM: < 2.90-1
Update to 2.90-1
dnsmasq Debian:14
- Affected ranges
- ECOSYSTEM: < 2.90-1
Update to 2.90-1
knot-resolver Debian:12
- Versions
- 5.6.0-1
- Affected ranges
- ECOSYSTEM: < 5.6.0-1+deb12u1
Update to 5.6.0-1+deb12u1
knot-resolver Debian:13
- Affected ranges
- ECOSYSTEM: < 5.7.1-1
Update to 5.7.1-1
knot-resolver Debian:14
- Affected ranges
- ECOSYSTEM: < 5.7.1-1
Update to 5.7.1-1
pdns-recursor Debian:12
- Versions
- 4.8.4-1
- Affected ranges
- ECOSYSTEM: < 4.8.6-1
Update to 4.8.6-1
pdns-recursor Debian:13
- Affected ranges
- ECOSYSTEM: < 4.9.3-1
Update to 4.9.3-1
pdns-recursor Debian:14
- Affected ranges
- ECOSYSTEM: < 4.9.3-1
Update to 4.9.3-1
systemd Debian:12
- Versions
- 252.11-1
- 252.11-1~deb12u1
- 252.12-1~deb12u1
- 252.14-1~deb12u1
- 252.16-1~deb12u1
- 252.17-1~deb12u1
- 252.18-1~deb12u1
- 252.19-1~deb12u1
- 252.20-1~deb12u1
- 252.21-1~deb12u1
- 252.22-1~deb12u1
- 252.6-1
- 252.6-1+loong64
- Affected ranges
- ECOSYSTEM: < 252.23-1~deb12u1
Update to 252.23-1~deb12u1
systemd Debian:13
- Affected ranges
- ECOSYSTEM: < 255.4-1
Update to 255.4-1
systemd Debian:14
- Affected ranges
- ECOSYSTEM: < 255.4-1
Update to 255.4-1
unbound Debian:12
- Versions
- 1.17.1-2
- 1.17.1-2+deb12u1
- Affected ranges
- ECOSYSTEM: < 1.17.1-2+deb12u2
Update to 1.17.1-2+deb12u2
unbound Debian:13
- Affected ranges
- ECOSYSTEM: < 1.19.1-1
Update to 1.19.1-1
unbound Debian:14
- Affected ranges
- ECOSYSTEM: < 1.19.1-1
Update to 1.19.1-1
bind9 Ubuntu:Pro:14.04:LTS
- Versions
- 1:9.9.3.dfsg.P2-4ubuntu1
- 1:9.9.3.dfsg.P2-4ubuntu2
- 1:9.9.3.dfsg.P2-4ubuntu3
- 1:9.9.5.dfsg-2
- 1:9.9.5.dfsg-3
- 1:9.9.5.dfsg-3ubuntu0.1
- 1:9.9.5.dfsg-3ubuntu0.2
- 1:9.9.5.dfsg-3ubuntu0.3
- 1:9.9.5.dfsg-3ubuntu0.4
- 1:9.9.5.dfsg-3ubuntu0.5
- 1:9.9.5.dfsg-3ubuntu0.6
- 1:9.9.5.dfsg-3ubuntu0.7
- 1:9.9.5.dfsg-3ubuntu0.8
- 1:9.9.5.dfsg-3ubuntu0.9
- 1:9.9.5.dfsg-3ubuntu0.10
- 1:9.9.5.dfsg-3ubuntu0.11
- 1:9.9.5.dfsg-3ubuntu0.12
- 1:9.9.5.dfsg-3ubuntu0.13
- 1:9.9.5.dfsg-3ubuntu0.14
- 1:9.9.5.dfsg-3ubuntu0.15
- 1:9.9.5.dfsg-3ubuntu0.16
- 1:9.9.5.dfsg-3ubuntu0.17
- 1:9.9.5.dfsg-3ubuntu0.18
- 1:9.9.5.dfsg-3ubuntu0.19
- 1:9.9.5.dfsg-3ubuntu0.19+esm1
- 1:9.9.5.dfsg-3ubuntu0.19+esm2
- 1:9.9.5.dfsg-3ubuntu0.19+esm3
- 1:9.9.5.dfsg-3ubuntu0.19+esm4
- 1:9.9.5.dfsg-3ubuntu0.19+esm5
- 1:9.9.5.dfsg-3ubuntu0.19+esm6
- 1:9.9.5.dfsg-3ubuntu0.19+esm7
- 1:9.9.5.dfsg-3ubuntu0.19+esm9
- 1:9.9.5.dfsg-3ubuntu0.19+esm10
- 1:9.9.5.dfsg-3ubuntu0.19+esm11
- Affected ranges
- ECOSYSTEM: < 1:9.9.5.dfsg-3ubuntu0.19+esm12
Update to 1:9.9.5.dfsg-3ubuntu0.19+esm12
unbound Ubuntu:Pro:14.04:LTS
- Versions
- 1.4.20-1
- 1.4.21-1
- 1.4.21-1ubuntu1
- 1.4.21-1ubuntu2
- 1.4.22-1ubuntu1
- 1.4.22-1ubuntu2
- 1.4.22-1ubuntu3
- 1.4.22-1ubuntu4
- 1.4.22-1ubuntu4.14.04.1
- 1.4.22-1ubuntu4.14.04.2
- 1.4.22-1ubuntu4.14.04.3
- 1.4.22-1ubuntu4.14.04.3+esm1
- 1.4.22-1ubuntu4.14.04.3+esm2
- 1.4.22-1ubuntu4.14.04.3+esm3
- 1.4.22-1ubuntu4.14.04.3+esm4
- Affected ranges
- ECOSYSTEM: < 1.4.22-1ubuntu4.14.04.3+esm5
Update to 1.4.22-1ubuntu4.14.04.3+esm5
Original sources
- https://www.athene-center.de/aktuelles/key-trap
- https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/
- https://kb.isc.org/docs/cve-2023-50387
- https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html
- https://www.theregister.com/2024/02/13/dnssec_vulnerability_internet/
- https://news.ycombinator.com/item?id=39367411
- https://www.securityweek.com/keytrap-dns-attack-could-disable-large-parts-of-internet-researchers/
- https://www.isc.org/blogs/2024-bind-security-release/
- https://news.ycombinator.com/item?id=39372384
- https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1
- https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-50387
- https://access.redhat.com/security/cve/CVE-2023-50387
- https://bugzilla.suse.com/show_bug.cgi?id=1219823
- https://www.athene-center.de/fileadmin/content/PDF/Technical_Report_KeyTrap.pdf
- http://www.openwall.com/lists/oss-security/2024/02/16/2
- http://www.openwall.com/lists/oss-security/2024/02/16/3
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/
- https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/
- https://nvd.nist.gov/vuln/detail/CVE-2023-50387