Skip to content

DNSJava vulnerable to KeyTrap - Denial-of-Service Algorithmic Complexity Attacks

Moderate severity GitHub Reviewed Published Jul 21, 2024 in dnsjava/dnsjava • Updated Sep 11, 2024

Package

maven dnsjava:dnsjava (Maven)

Affected versions

>= 3.5.0, < 3.6.0

Patched versions

3.6.0
maven org.jitsi:dnssecjava (Maven)
<= 2.0.0
None

Description

Impact

Users using the ValidatingResolver for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.

Patches

Users should upgrade to dnsjava v3.6.0

Workarounds

Although not recommended, only using a non-validating resolver, will remove the vulnerability.

References

https://www.athene-center.de/en/keytrap

References

@ibauersachs ibauersachs published to dnsjava/dnsjava Jul 21, 2024
Published to the GitHub Advisory Database Jul 22, 2024
Reviewed Jul 22, 2024
Last updated Sep 11, 2024

Severity

Moderate

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-crjg-w57m-rqqf

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.