Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2023-2829

Malformed NSEC records can cause named to terminate unexpectedly when synth-from-dnssec is enabled

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
isc

Description

A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from-dnssec`) enabled can be remotely terminated using a zone with a malformed NSEC record. This issue affects BIND 9 versions 9.16.8-S1 through 9.16.41-S1 and 9.18.11-S1 through 9.18.15-S1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ISC BIND 9

Default version status: unaffected

  • 9.16.8-S1 to ≤ 9.16.41-S1affected
  • 9.18.11-S1 to ≤ 9.18.15-S1affected

References