CVE-2023-50387

Katalog CVE

CVSS 7.5 · High EPSS 100,0%

Kerentanan Allocation of Resources Without Limits or Throttling pada redhat enterprise linux, microsoft windows server 2008 +11 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Rincian

Terbit di NVD

14 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

100,0% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-50387 patch · advisory vendor
• https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ advisory vendor
• https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 patch
• https://www.theregister.com/2024/02/13/dnssec_vulnerability_internet/ patch · advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2023-50387 advisory pihak ketiga
• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html advisory pihak ketiga
• https://kb.isc.org/docs/cve-2023-50387 advisory pihak ketiga · vdb entry
• https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html mailing list · advisory pihak ketiga
• https://news.ycombinator.com/item?id=39367411 advisory pihak ketiga
• https://www.athene-center.de/aktuelles/key-trap advisory pihak ketiga
• https://www.athene-center.de/fileadmin/content/PDF/Technical_Report_KeyTrap.pdf deskripsi teknis · advisory pihak ketiga
• https://www.isc.org/blogs/2024-bind-security-release/ advisory pihak ketiga
• https://www.securityweek.com/keytrap-dns-attack-could-disable-large-parts-of-internet-researchers/ press/media coverage · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2024/02/16/2 mailing list
• http://www.openwall.com/lists/oss-security/2024/02/16/3 mailing list
• https://bugzilla.suse.com/show_bug.cgi?id=1219823 issue tracking
• https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html
• https://lists.debian.org/debian-lts-announce/2024/05/msg00011.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UH... mailing list
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXK...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5J...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7N... mailing list
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUST...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCID... mailing list