CVE-2023-50868

HIGH EPSS 99.6%

Published Feb 14, 20242y ago · Modified Jun 17, 20262w ago

7.5 CVSS 3.1

High

Published Feb 14, 2024 2y ago

Last Modified Jun 17, 2026 2w ago

Description

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

CVSS Details

Base Score

7.5

Exploitability

3.9

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

99.6% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-400 Uncontrolled Resource Consumption Resource Mgmt

Affected Products 26

Vendor	Product	Version	Range
netapp	hci_baseboard_management_controller	*	any
netapp	h300s	*	any
netapp	h410c	*	any
netapp	h410s	*	any
netapp	h500s	*	any
netapp	h700s	*	any
netapp	active_iq_unified_manager	*	any
netapp	bootstrap_os	*	any
netapp	hci_compute_node	*	any
powerdns	recursor	*	<4.8.5
powerdns	recursor	*	≥4.9.0 – <4.9.3
powerdns	recursor	*	≥5.0.0 – <5.0.2
redhat	enterprise_linux	6.0	any
redhat	enterprise_linux	7.0	any
redhat	enterprise_linux	8.0	any
redhat	enterprise_linux	8.2	any
redhat	enterprise_linux	8.4	any
debian	debian_linux	10.0	any
debian	debian_linux	11.0	any
fedoraproject	fedora	38	any
fedoraproject	fedora	39	any
isc	bind	*	≥9.0.0 – <9.16.48
isc	bind	*	≥9.9.3 – <9.16.48
isc	bind	*	≥9.18.0 – <9.18.24
isc	bind	*	≥9.18.11 – <9.18.24
isc	bind	*	≥9.19.0 – <9.19.21

References 29

openwall.com http://www.openwall.com/lists/oss-security/2024/02/16/2

Issue TrackingMailing List
openwall.com http://www.openwall.com/lists/oss-security/2024/02/16/3

Issue TrackingMailing List
access.redhat.com https://access.redhat.com/security/cve/CVE-2023-50868

Vendor Advisory
bugzilla.suse.com https://bugzilla.suse.com/show_bug.cgi?id=1219826

Issue Tracking
datatracker.ietf.org https://datatracker.ietf.org/doc/html/rfc5155

Technical Description
docs.powerdns.com https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html

Vendor Advisory
gitlab.nic.cz https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1

Release Notes
kb.isc.org https://kb.isc.org/docs/cve-2023-50868

Third Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html

Mailing ListVendor Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2024/05/msg00011.html

Mailing ListVendor Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2024/09/msg00001.html

Mailing ListVendor Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2024/11/msg00035.html

Mailing ListVendor Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/

Mailing ListVendor Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/

Mailing ListVendor Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/

Mailing ListVendor Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/

Mailing ListVendor Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/

Mailing ListVendor Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/

Mailing ListVendor Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/

Mailing ListVendor Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/

Mailing ListVendor Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/

Mailing ListVendor Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/

Mailing ListVendor Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/

Mailing ListVendor Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/

Mailing ListVendor Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/

Mailing ListVendor Advisory
lists.thekelleys.org.uk https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html

Mailing ListRelease Notes
nlnetlabs.nl https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/

Release Notes
security.netapp.com https://security.netapp.com/advisory/ntap-20240307-0008/

Vendor Advisory
isc.org https://www.isc.org/blogs/2024-bind-security-release/

ExploitMitigationPress/Media Coverage

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.