peterzen/goresolver · Security
go-resolver's DNSSEC validation not performed correctly
- GHSA ID
- GHSA-jr65-gpj5-cw74
- CVE ID
- CVE-2022-3347
- Severity
- high
- Published
- Updated
- CVSS
- 7.7 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
- CVSS v3
- 7.7 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Description
go-resolver's DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. Root DNSSEC public keys are not validated, permitting an attacker to present a self-signed root key and delegation chain.
CWEs
- CWE-345 · Insufficient Verification of Data Authenticity
- CWE-347 · Improper Verification of Cryptographic Signature