dnsmasq-2.79-31.el8_9.2
エラータID: AXSA:2024-7620:02
The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.
Security Fix(es):
* dnsmasq: bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387)
* dnsmasq: bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2023-50387
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
CVE-2023-50868
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
Update packages.
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
N/A
SRPMS
- dnsmasq-2.79-31.el8_9.2.src.rpm
MD5: 4a88e1e55c2d88fbc592f140fe5a435b
SHA-256: 4d3b95b97b5e383161063703b632a9615ad2695ecb88801e415dfc06f046ae9a
Size: 625.89 kB
Asianux Server 8 for x86_64
- dnsmasq-2.79-31.el8_9.2.x86_64.rpm
MD5: 5c5a368838079d2fa43fa677e1951218
SHA-256: c889c8a8588ea97f84947da56846317b283afb9535a9920e2809d046cc1f5470
Size: 323.16 kB - dnsmasq-utils-2.79-31.el8_9.2.x86_64.rpm
MD5: bea7aa496f69132ed9011f630bb1131c
SHA-256: bdc9a15332cb9898b78704ab6e991b0d5bb0bb44d0e852beb23bc526085e1831
Size: 56.01 kB