CVE-2023-50387

HIGH EPSS 100.0%
Published Feb 14, 20242y ago · Modified Jun 17, 20261w ago
7.5 CVSS 3.1
High
Find Similar
Published Feb 14, 2024 2y ago
Last Modified Jun 17, 2026 1w ago

Description

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
100.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-770

Affected Products 21

VendorProductVersionRange
redhatenterprise_linux6.0any
redhatenterprise_linux7.0any
redhatenterprise_linux8.0any
redhatenterprise_linux9.0any
microsoftwindows_server_2008r2any
microsoftwindows_server_2012*any
microsoftwindows_server_2012r2any
microsoftwindows_server_2016*any
microsoftwindows_server_2019*any
microsoftwindows_server_2022*any
microsoftwindows_server_2022_23h2*any
fedoraprojectfedora39any
thekelleysdnsmasq* <2.90
nicknot_resolver* <5.71
powerdnsrecursor*≥4.8.0  –  <4.8.6
powerdnsrecursor*≥4.9.0  –  <4.9.3
powerdnsrecursor*≥5.0.0  –  <5.0.2
iscbind*≥9.0.0  –  ≤9.16.46
iscbind*≥9.18.0  –  ≤9.18.22
iscbind*≥9.19.0  –  ≤9.19.20
nlnetlabsunbound* <1.19.1

References 36

  • openwall.com http://www.openwall.com/lists/oss-security/2024/02/16/2
    Mailing List
  • openwall.com http://www.openwall.com/lists/oss-security/2024/02/16/3
    Mailing List
  • access.redhat.com https://access.redhat.com/security/cve/CVE-2023-50387
    Third Party Advisory
  • bugzilla.suse.com https://bugzilla.suse.com/show_bug.cgi?id=1219823
    Issue Tracking
  • docs.powerdns.com https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html
    Third Party Advisory
  • gitlab.nic.cz https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1
    Patch
  • kb.isc.org https://kb.isc.org/docs/cve-2023-50387
    Third Party AdvisoryVDB Entry
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2024/05/msg00011.html
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2024/09/msg00001.html
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2024/11/msg00035.html
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/
    Mailing List
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/
    Mailing List
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/
    Mailing List
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/
  • lists.thekelleys.org.uk https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html
    Mailing ListThird Party Advisory
  • msrc.microsoft.com https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-50387
    PatchVendor Advisory
  • news.ycombinator.com https://news.ycombinator.com/item?id=39367411
    Third Party Advisory
  • news.ycombinator.com https://news.ycombinator.com/item?id=39372384
    Issue Tracking
  • nlnetlabs.nl https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/
    Vendor Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20240307-0007/
  • athene-center.de https://www.athene-center.de/aktuelles/key-trap
    Third Party Advisory
  • athene-center.de https://www.athene-center.de/fileadmin/content/PDF/Technical_Report_KeyTrap.pdf
    Technical DescriptionThird Party Advisory
  • isc.org https://www.isc.org/blogs/2024-bind-security-release/
    Third Party Advisory
  • securityweek.com https://www.securityweek.com/keytrap-dns-attack-could-disable-large-parts-of-internet-researchers/
    Press/Media CoverageThird Party Advisory
  • theregister.com https://www.theregister.com/2024/02/13/dnssec_vulnerability_internet/
    PatchThird Party Advisory

Remediation

  • gitlab.nic.cz https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1
    Patch
  • msrc.microsoft.com https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-50387
    PatchVendor Advisory
  • theregister.com https://www.theregister.com/2024/02/13/dnssec_vulnerability_internet/
    PatchThird Party Advisory