CVE-2022-3347

2022-12-2803:15:10

CWE-345

web.nvd.nist.gov

cve-2022-3347

dnssec

validation

security

vulnerability

nvd

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

34.6%

JSON

DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. Root DNSSEC public keys are not validated, permitting an attacker to present a self-signed root key and delegation chain.

Affected configurations

Nvd

Node

go-resolver_projectgo-resolverMatch-go

VendorProductVersionCPE
go-resolver_projectgo-resolver-cpe:2.3:a:go-resolver_project:go-resolver:-:*:*:*:*:go:*:*

Vendor	Product	Version	CPE
go-resolver_project	go-resolver	-	cpe:2.3:a:go-resolver_project:go-resolver:-:::::go::

CNA Affected

[
  {
    "vendor": "github.com/peterzen/goresolver",
    "product": "github.com/peterzen/goresolver",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "github.com/peterzen/goresolver",
    "defaultStatus": "affected"
  }
]