CVE-2023-50868

2024-02-1300:00:00

ubuntu.com

cve-2023-50868

remote attackers

dns protocol

rfc 5155

rfc 9276

denial of service

cpu consumption

sha-1 computations

dnssec

nsec3

algorithm

isc-dhcp-4.4.3-1

bind9 libs

vulnerability

unix

7.5 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.2%

JSON

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC
9276 guidance is skipped) allows remote attackers to cause a denial of
service (CPU consumption for SHA-1 computations) via DNSSEC responses in a
random subdomain attack, aka the “NSEC3” issue. The RFC 5155 specification
implies that an algorithm must perform thousands of iterations of a hash
function in certain situations.

Notes

Author	Note
alexmurray	As of isc-dhcp-4.4.3-1, isc-dhcp vendors bind9 libs
mdeslaur	This is unlikely to affect isc-dhcp’s use of bind9-libs and the vendored bind9 libs, marking as negligible

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchbind9< 1:9.11.3+dfsg-1ubuntu1.19+esm3UNKNOWN
ubuntu20.04noarchbind9< 1:9.16.48-0ubuntu0.20.04.1UNKNOWN
ubuntu22.04noarchbind9< 1:9.18.18-0ubuntu0.22.04.2UNKNOWN
ubuntu23.10noarchbind9< 1:9.18.18-0ubuntu2.1UNKNOWN
ubuntu24.04noarchbind9< 1:9.18.24-0ubuntu1UNKNOWN
ubuntu14.04noarchbind9< 1:9.9.5.dfsg-3ubuntu0.19+esm12UNKNOWN
ubuntu16.04noarchbind9< 1:9.10.3.dfsg.P4-8ubuntu1.19+esm8UNKNOWN
ubuntu20.04noarchbind9-libs< anyUNKNOWN
ubuntu22.04noarchbind9-libs< anyUNKNOWN
ubuntu18.04noarchdnsmasq< 2.90-0ubuntu0.18.04.1+esm1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	bind9	< 1:9.11.3+dfsg-1ubuntu1.19+esm3	UNKNOWN
ubuntu	20.04	noarch	bind9	< 1:9.16.48-0ubuntu0.20.04.1	UNKNOWN
ubuntu	22.04	noarch	bind9	< 1:9.18.18-0ubuntu0.22.04.2	UNKNOWN
ubuntu	23.10	noarch	bind9	< 1:9.18.18-0ubuntu2.1	UNKNOWN
ubuntu	24.04	noarch	bind9	< 1:9.18.24-0ubuntu1	UNKNOWN
ubuntu	14.04	noarch	bind9	< 1:9.9.5.dfsg-3ubuntu0.19+esm12	UNKNOWN
ubuntu	16.04	noarch	bind9	< 1:9.10.3.dfsg.P4-8ubuntu1.19+esm8	UNKNOWN
ubuntu	20.04	noarch	bind9-libs	< any	UNKNOWN
ubuntu	22.04	noarch	bind9-libs	< any	UNKNOWN
ubuntu	18.04	noarch	dnsmasq	< 2.90-0ubuntu0.18.04.1+esm1	UNKNOWN