dnsmasq-2.85-14.el9_3.1
エラータID: AXSA:2024-7618:01
リリース日:
2024/03/19 Tuesday - 10:41
題名:
dnsmasq-2.85-14.el9_3.1
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- BIND の DNSSEC の処理には、多数の DNSKEY および RRSIG
レコードを持つゾーンが存在している場合、リモートの攻撃者に
より、細工された DNSSEC 応答の受信を介して、サービス拒否
攻撃 (CPU リソースの枯渇) を可能とする脆弱性が存在します。
(CVE-2023-50387)
- BIND の最近接名の解決機能には、リモートの攻撃者により、
DNSSEC 署名ゾーンの NSEC3 レコードを含む応答を DNSSEC
リゾルバーに引き渡すことを介して、サービス拒否攻撃 (CPU
リソースの枯渇) を可能とする脆弱性が存在します。
(CVE-2023-50868)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2023-50387
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
CVE-2023-50868
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
追加情報:
N/A
ダウンロード:
SRPMS
- dnsmasq-2.85-14.el9_3.1.src.rpm
MD5: 8e42b9ea86241a9d2c2b7d93b7b6c3a8
SHA-256: 7d392517344b30eacaffd8dd81c7e6a3f252f54a49a9b0f5851afa126f4b5488
Size: 576.64 kB
Asianux Server 9 for x86_64
- dnsmasq-2.85-14.el9_3.1.x86_64.rpm
MD5: 5c83e74e5f36fa305ea5f075323c9384
SHA-256: 0298fb15ec391fd160559f50d3879888786b2b213fe7d01ba3da8e75a7f8c912
Size: 329.60 kB - dnsmasq-utils-2.85-14.el9_3.1.x86_64.rpm
MD5: 4bd6de8cd5ebc5e04ba430b9c46bdda6
SHA-256: 4072174fbb539e04bde0ca8c22e09b1367f5f4bdd8bb43289479439a6e0aaac4
Size: 38.45 kB
English