Re: Unbound: disclosure of CVE-2023-50387 and CVE-2023-50868 DNSSEC validation vulnerabilities

[Solar Designer <solar () openwall com>]

On Tue, Feb 13, 2024 at 12:06:42PM -0800, Alan Coopersmith wrote:
> On 2/13/24 06:07, Yorgos Thessalonikefs wrote:
> > DNSSEC protocol vulnerabilities have been discovered that render various
> > DNSSEC validators victims of Denial Of Service while trying to validate
> > specially crafted DNSSEC responses.
> >
> > There are two known vulnerabilities: CVE-2023-50387 (referred here as
> > the KeyTrap vulnerability) and CVE-2023-50868 (referred here as the
> > NSEC3 vulnerability).
>
> Similarly, dnsmasq 2.90 was published today to address these:
> https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html

And fixes for these two CVEs were merged into PowerDNS today:

https://github.com/PowerDNS/pdns/pull/13781

I hope PowerDNS will also be sending a proper advisory in here.

Alexander