Debian Security Bug TrackerDEBIANCVE:CVE-2023-50868

HistoryFeb 14, 2024 - 4:15 p.m.

CVE-2023-50868

2024-02-1416:15:45

Debian Security Bug Tracker

security-tracker.debian.org

cve-2023-50868

closest encloser proof

dns protocol

denial of service

cpu consumption

sha-1 computations

dnssec responses

nsec3 issue

rfc 5155

algorithm

hash function

subdomain attack

7.5 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.2%

JSON

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the “NSEC3” issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

OSVersionArchitecturePackageVersionFilename
Debian12allbind9< 1:9.18.24-1bind9_1:9.18.24-1_all.deb
Debian11allbind9< 1:9.16.48-1bind9_1:9.16.48-1_all.deb
Debian10allbind9< 1:9.11.5.P4+dfsg-5.1+deb10u11bind9_1:9.11.5.P4+dfsg-5.1+deb10u11_all.deb
Debian999allbind9< 1:9.19.21-1bind9_1:9.19.21-1_all.deb
Debian13allbind9< 1:9.19.21-1bind9_1:9.19.21-1_all.deb
Debian12alldnsmasq<= 2.89-1dnsmasq_2.89-1_all.deb
Debian11alldnsmasq<= 2.85-1dnsmasq_2.85-1_all.deb
Debian10alldnsmasq<= 2.80-1+deb10u1dnsmasq_2.80-1+deb10u1_all.deb
Debian999alldnsmasq< 2.90-1dnsmasq_2.90-1_all.deb
Debian13alldnsmasq< 2.90-1dnsmasq_2.90-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	bind9	< 1:9.18.24-1	bind9_1:9.18.24-1_all.deb
Debian	11	all	bind9	< 1:9.16.48-1	bind9_1:9.16.48-1_all.deb
Debian	10	all	bind9	< 1:9.11.5.P4+dfsg-5.1+deb10u11	bind9_1:9.11.5.P4+dfsg-5.1+deb10u11_all.deb
Debian	999	all	bind9	< 1:9.19.21-1	bind9_1:9.19.21-1_all.deb
Debian	13	all	bind9	< 1:9.19.21-1	bind9_1:9.19.21-1_all.deb
Debian	12	all	dnsmasq	<= 2.89-1	dnsmasq_2.89-1_all.deb
Debian	11	all	dnsmasq	<= 2.85-1	dnsmasq_2.85-1_all.deb
Debian	10	all	dnsmasq	<= 2.80-1+deb10u1	dnsmasq_2.80-1+deb10u1_all.deb
Debian	999	all	dnsmasq	< 2.90-1	dnsmasq_2.90-1_all.deb
Debian	13	all	dnsmasq	< 2.90-1	dnsmasq_2.90-1_all.deb

Rows per page:

1-10 of 301