CVE-2020-35857 Stack consumption in trust-dns-server
Attackers can cause stack consumption and denial of service by sending DNS MX or SRV records with null targets to applications using the trust-dns-server crate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-35857?
CVE-2020-35857 is a high-severity denial of service vulnerability in n/a, published on 31 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust. DNS MX and SRV null targets are mishandled, causing stack consumption.
Weakness: CWE-400
Which versions are affected by CVE-2020-35857?
3 open source packages ship an affected version, including trust-dns-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
trust-dns-server crates.io | From 0.16.0 | 0.18.1 |
trust-dns-server crates.io | From 0.16.0 | 0.18.1 |
trust-dns-server crates.io | From 0.16.0 | 0.18.1 |
Products include Trust-Dns-Server Project Trust-Dns-Server.
How do I fix CVE-2020-35857?
Upgrade trust-dns-server to 0.18.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-35857 being exploited?
There is no known exploitation of CVE-2020-35857 in the wild and no public exploit code.
Sources
Also known as GHSA-4cww-f7w5-x525, RUSTSEC-2020-0001.