peterzen/goresolver · Security
go-resolver vulnerable to attacker-controlled domains due to unvalidated RRSIG RRs
- GHSA ID
- GHSA-87mm-qxm5-cp3f
- CVE ID
- CVE-2022-3346
- Severity
- high
- Published
- Updated
- CVSS
- 7.7 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
- CVSS v3
- 7.7 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Description
go-resolver's DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The owner name of RRSIG RRs is not validated, permitting an attacker to present the RRSIG for an attacker-controlled domain in a response for any other domain.
CWEs
- CWE-345 · Insufficient Verification of Data Authenticity