CVE-2024-25638
CVE-2024-25638 · DNSJava DNSSEC Bypass
This page contains facts from public vulnerability sources. Check the original advisory before updating.
dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.
CVSS 8.9 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
dnsjava
- Versions
- < 3.6.0: Affected
No fix published
dnsjava Debian:12
- Versions
- 2.1.8-2
- 3.6.2-1
- 3.6.2-2
- 3.6.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dnsjava Debian:13
- Affected ranges
- ECOSYSTEM: < 3.6.2-1
Update to 3.6.2-1
dnsjava Debian:14
- Affected ranges
- ECOSYSTEM: < 3.6.2-1
Update to 3.6.2-1
dnsjava Ubuntu:16.04:LTS
- Versions
- 2.1.7-0.1
- 2.1.7+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dnsjava Ubuntu:18.04:LTS
- Versions
- 2.1.8-1
- 2.1.8-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dnsjava Ubuntu:20.04:LTS
- Versions
- 2.1.8-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dnsjava Ubuntu:22.04:LTS
- Versions
- 2.1.8-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dnsjava Ubuntu:24.04:LTS
- Versions
- 2.1.8-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dnsjava Ubuntu:25.10
- Versions
- 3.6.2-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dnsjava Ubuntu:26.10
- Versions
- 3.6.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dnsjava Ubuntu:26.04:LTS
- Versions
- 3.6.2-2
- 3.6.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published