The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the “NSEC3” issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Alpine | edge-community | noarch | knot-resolver | < 5.7.1-r0 | UNKNOWN |
Alpine | edge-community | noarch | pdns-recursor | < 5.0.2-r0 | UNKNOWN |
Alpine | edge-main | noarch | bind | < 9.18.24-r0 | UNKNOWN |
Alpine | edge-main | noarch | dnsmasq | < 2.90-r0 | UNKNOWN |
Alpine | edge-main | noarch | unbound | < 1.19.1-r0 | UNKNOWN |
Alpine | 3.16-main | noarch | bind | < 9.16.48-r0 | UNKNOWN |
Alpine | 3.17-main | noarch | bind | < 9.18.24-r0 | UNKNOWN |
Alpine | 3.17-main | noarch | dnsmasq | < 2.90-r0 | UNKNOWN |
Alpine | 3.17-main | noarch | unbound | < 1.19.1-r0 | UNKNOWN |
Alpine | 3.18-community | noarch | knot-resolver | < 5.7.1-r0 | UNKNOWN |