CVE-2022-3346 Incorrect DNSSEC validation due to unchecked owner names in github.com/peterzen/goresolver
An attacker can bypass DNSSEC validation in the goresolver library by presenting valid signatures for unrelated domains, leading to acceptance of malicious DNS records.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-3346?
CVE-2022-3346 is a medium-severity vulnerability in github.com/peterzen/goresolver, published on 27 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The owner name of RRSIG RRs is not validated, permitting an attacker to present the RRSIG for an attacker-controlled domain in a response for any other domain.
Weakness: CWE-345
Which versions are affected by CVE-2022-3346?
3 open source packages ship an affected version, including github.com/peterzen/goresolver. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/peterzen/goresolver Go | All versions | None |
github.com/peterzen/goresolver Go | All versions to 1.0.2 | None |
github.com/peterzen/goresolver Go | All versions to 1.0.2 | None |
Products include Go-Resolver Project Go-Resolver.
How do I fix CVE-2022-3346?
No fix has been published for CVE-2022-3346 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-3346 being exploited?
There is no known exploitation of CVE-2022-3346 in the wild and no public exploit code.
Other vulnerabilities in github.com/peterzen/goresolver
Sources
Also known as GHSA-87mm-qxm5-cp3f, GO-2022-0979.