GHSA-mmwx-rj87-vfgr DNSJava affected by KeyTrap - NSEC3 closest encloser proof can exhaust CPU resources
Attackers can cause CPU exhaustion in applications using dnsjava's ValidatingResolver by sending specially crafted DNSSEC responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-mmwx-rj87-vfgr?
GHSA-mmwx-rj87-vfgr is a denial of service vulnerability in dnsjava:dnsjava, published on 22 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Users using the ValidatingResolver for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.
Patches
Users should upgrade to dnsjava v3.6.0
Workarounds
Although not recommended, only using a non-validating resolver, will remove the vulnerability.
References
Which versions are affected by GHSA-mmwx-rj87-vfgr?
4 open source packages ship an affected version, including dnsjava:dnsjava and org.jitsi:dnssecjava.
| Package | Affected | Fixed in |
|---|---|---|
dnsjava:dnsjava Maven | From 3.5.0 | 3.6.0 |
dnsjava:dnsjava Maven | From 3.5.0 | 3.6.0 |
org.jitsi:dnssecjava Maven | All versions to 2.0.0 | None |
org.jitsi:dnssecjava Maven | All versions to 2.0.0 | None |
How do I fix GHSA-mmwx-rj87-vfgr?
Upgrade dnsjava:dnsjava to 3.6.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-mmwx-rj87-vfgr being exploited?
There is no known exploitation of GHSA-mmwx-rj87-vfgr in the wild and no public exploit code.