The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the “NSEC3” issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 12 | all | bind9 | < 1:9.18.24-1 | bind9_1:9.18.24-1_all.deb |
Debian | 11 | all | bind9 | < 1:9.16.48-1 | bind9_1:9.16.48-1_all.deb |
Debian | 999 | all | bind9 | < 1:9.19.21-1 | bind9_1:9.19.21-1_all.deb |
Debian | 13 | all | bind9 | < 1:9.19.21-1 | bind9_1:9.19.21-1_all.deb |
Debian | 12 | all | dnsmasq | <= 2.89-1 | dnsmasq_2.89-1_all.deb |
Debian | 11 | all | dnsmasq | <= 2.85-1 | dnsmasq_2.85-1_all.deb |
Debian | 999 | all | dnsmasq | < 2.90-1 | dnsmasq_2.90-1_all.deb |
Debian | 13 | all | dnsmasq | < 2.90-1 | dnsmasq_2.90-1_all.deb |
Debian | 12 | all | knot-resolver | < 5.6.0-1+deb12u1 | knot-resolver_5.6.0-1+deb12u1_all.deb |
Debian | 11 | all | knot-resolver | <= 5.3.1-1+deb11u1 | knot-resolver_5.3.1-1+deb11u1_all.deb |