CVE-2023-50868
CVE-2023-50868
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
CVSS 7.5 · High · EPSS 74.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
bind9 Debian:12
- Versions
- 1:9.18.12-1
- 1:9.18.13-1
- 1:9.18.16-1
- 1:9.18.16-1~deb12u1
- 1:9.18.16-1~deb12u1~bpo11+1
- 1:9.18.19-1~deb12u1
- 1:9.18.19-1~deb12u1~bpo11+1
- 1:9.18.24-1~bpo11+1
- Affected ranges
- ECOSYSTEM: < 1:9.18.24-1
Update to 1:9.18.24-1
bind9 Debian:13
- Affected ranges
- ECOSYSTEM: < 1:9.19.21-1
Update to 1:9.19.21-1
bind9 Debian:14
- Affected ranges
- ECOSYSTEM: < 1:9.19.21-1
Update to 1:9.19.21-1
dnsjava Debian:12
- Versions
- 2.1.8-2
- 3.6.2-1
- 3.6.2-2
- 3.6.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dnsjava Debian:13
- Affected ranges
- ECOSYSTEM: < 3.6.2-1
Update to 3.6.2-1
dnsjava Debian:14
- Affected ranges
- ECOSYSTEM: < 3.6.2-1
Update to 3.6.2-1
dnsmasq Debian:12
- Versions
- 2.89-1
- 2.90-1
- 2.90-2
- 2.90-3
- Affected ranges
- ECOSYSTEM: < 2.90-4~deb12u1
Update to 2.90-4~deb12u1
dnsmasq Debian:13
- Affected ranges
- ECOSYSTEM: < 2.90-1
Update to 2.90-1
dnsmasq Debian:14
- Affected ranges
- ECOSYSTEM: < 2.90-1
Update to 2.90-1
knot-resolver Debian:12
- Versions
- 5.6.0-1
- Affected ranges
- ECOSYSTEM: < 5.6.0-1+deb12u1
Update to 5.6.0-1+deb12u1
knot-resolver Debian:13
- Affected ranges
- ECOSYSTEM: < 5.7.1-1
Update to 5.7.1-1
knot-resolver Debian:14
- Affected ranges
- ECOSYSTEM: < 5.7.1-1
Update to 5.7.1-1
pdns-recursor Debian:12
- Versions
- 4.8.4-1
- Affected ranges
- ECOSYSTEM: < 4.8.6-1
Update to 4.8.6-1
pdns-recursor Debian:13
- Affected ranges
- ECOSYSTEM: < 4.9.3-1
Update to 4.9.3-1
pdns-recursor Debian:14
- Affected ranges
- ECOSYSTEM: < 4.9.3-1
Update to 4.9.3-1
systemd Debian:12
- Versions
- 252.11-1
- 252.11-1~deb12u1
- 252.12-1~deb12u1
- 252.14-1~deb12u1
- 252.16-1~deb12u1
- 252.17-1~deb12u1
- 252.18-1~deb12u1
- 252.19-1~deb12u1
- 252.20-1~deb12u1
- 252.21-1~deb12u1
- 252.22-1~deb12u1
- 252.6-1
- 252.6-1+loong64
- Affected ranges
- ECOSYSTEM: < 252.23-1~deb12u1
Update to 252.23-1~deb12u1
systemd Debian:13
- Affected ranges
- ECOSYSTEM: < 255.4-1
Update to 255.4-1
systemd Debian:14
- Affected ranges
- ECOSYSTEM: < 255.4-1
Update to 255.4-1
unbound Debian:12
- Versions
- 1.17.1-2
- 1.17.1-2+deb12u1
- Affected ranges
- ECOSYSTEM: < 1.17.1-2+deb12u2
Update to 1.17.1-2+deb12u2
unbound Debian:13
- Affected ranges
- ECOSYSTEM: < 1.19.1-1
Update to 1.19.1-1
unbound Debian:14
- Affected ranges
- ECOSYSTEM: < 1.19.1-1
Update to 1.19.1-1
bind9 Ubuntu:Pro:14.04:LTS
- Versions
- 1:9.9.3.dfsg.P2-4ubuntu1
- 1:9.9.3.dfsg.P2-4ubuntu2
- 1:9.9.3.dfsg.P2-4ubuntu3
- 1:9.9.5.dfsg-2
- 1:9.9.5.dfsg-3
- 1:9.9.5.dfsg-3ubuntu0.1
- 1:9.9.5.dfsg-3ubuntu0.2
- 1:9.9.5.dfsg-3ubuntu0.3
- 1:9.9.5.dfsg-3ubuntu0.4
- 1:9.9.5.dfsg-3ubuntu0.5
- 1:9.9.5.dfsg-3ubuntu0.6
- 1:9.9.5.dfsg-3ubuntu0.7
- 1:9.9.5.dfsg-3ubuntu0.8
- 1:9.9.5.dfsg-3ubuntu0.9
- 1:9.9.5.dfsg-3ubuntu0.10
- 1:9.9.5.dfsg-3ubuntu0.11
- 1:9.9.5.dfsg-3ubuntu0.12
- 1:9.9.5.dfsg-3ubuntu0.13
- 1:9.9.5.dfsg-3ubuntu0.14
- 1:9.9.5.dfsg-3ubuntu0.15
- 1:9.9.5.dfsg-3ubuntu0.16
- 1:9.9.5.dfsg-3ubuntu0.17
- 1:9.9.5.dfsg-3ubuntu0.18
- 1:9.9.5.dfsg-3ubuntu0.19
- 1:9.9.5.dfsg-3ubuntu0.19+esm1
- 1:9.9.5.dfsg-3ubuntu0.19+esm2
- 1:9.9.5.dfsg-3ubuntu0.19+esm3
- 1:9.9.5.dfsg-3ubuntu0.19+esm4
- 1:9.9.5.dfsg-3ubuntu0.19+esm5
- 1:9.9.5.dfsg-3ubuntu0.19+esm6
- 1:9.9.5.dfsg-3ubuntu0.19+esm7
- 1:9.9.5.dfsg-3ubuntu0.19+esm9
- 1:9.9.5.dfsg-3ubuntu0.19+esm10
- 1:9.9.5.dfsg-3ubuntu0.19+esm11
- Affected ranges
- ECOSYSTEM: < 1:9.9.5.dfsg-3ubuntu0.19+esm12
Update to 1:9.9.5.dfsg-3ubuntu0.19+esm12
dnsmasq Ubuntu:Pro:14.04:LTS
- Versions
- 2.66-4ubuntu1
- 2.67-1
- 2.68-1
- 2.68-1ubuntu0.1
- 2.68-1ubuntu0.2
- 2.68-1ubuntu0.2+esm1
- 2.68-1ubuntu0.2+esm2
- 2.68-1ubuntu0.2+esm3
- 2.68-1ubuntu0.2+esm5
- 2.68-1ubuntu0.2+esm6
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/
- https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html
- https://www.isc.org/blogs/2024-bind-security-release/
- https://datatracker.ietf.org/doc/html/rfc5155
- https://kb.isc.org/docs/cve-2023-50868
- https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1
- https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html
- https://access.redhat.com/security/cve/CVE-2023-50868
- https://bugzilla.suse.com/show_bug.cgi?id=1219826
- http://www.openwall.com/lists/oss-security/2024/02/16/2
- http://www.openwall.com/lists/oss-security/2024/02/16/3
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/
- https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/
- https://security.netapp.com/advisory/ntap-20240307-0008/
- https://nvd.nist.gov/vuln/detail/CVE-2023-50868