{"answers":{"affected":"5 open source packages ship an affected version, including hickory-proto.","exploited":"There is no known exploitation of GHSA-v7pc-74h8-xq2h in the wild and no public exploit code.","fix":"Upgrade hickory-proto to a fixed version for your release line: 0.25.0-alpha.5 or 0.24.3.","what":"GHSA-v7pc-74h8-xq2h is a vulnerability in hickory-proto, published on 7 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-v7pc-74h8-xq2h and fix it if it is affected.\n\nWhat it is: GHSA-v7pc-74h8-xq2h is a vulnerability in hickory-proto, published on 7 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-v7pc-74h8-xq2h in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- hickory-proto (crates.io): affected from 0.25.0-alpha.1; fixed in 0.25.0-alpha.5\n- hickory-proto (crates.io): affected from 0.25.0-alpha.1; fixed in 0.25.0-alpha.5\n- hickory-proto (crates.io): affected from 0.8.0; fixed in 0.24.3, 0.25.0-alpha.5\n- hickory-proto (crates.io): affected from 0.8.0; fixed in 0.24.3\n- hickory-proto (crates.io): affected from 0.8.0; fixed in 0.24.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-v7pc-74h8-xq2h/ (Markdown: https://insights.sbomify.com/GHSA-v7pc-74h8-xq2h/index.md)","id":"GHSA-v7pc-74h8-xq2h","markdown":"https://insights.sbomify.com/GHSA-v7pc-74h8-xq2h/index.md","name":"GHSA-v7pc-74h8-xq2h","record":{"aliases":["RUSTSEC-2025-0006"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Rust DNS library","requires_auth":"none","summary":"Attackers can bypass DNSSEC validation by exploiting trust anchor logic, allowing them to spoof DNS responses and redirect traffic.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Summary\n\nThe DNSSEC validation routines treat entire RRsets of DNSKEY records as trusted once they have established trust in only one of the DNSKEYs. As a result, if a zone includes a DNSKEY with a public key that matches a configured trust anchor, all keys in that zone will be trusted to authenticate other records in the zone. There is a second variant of this vulnerability involving DS records, where an authenticated DS record covering one DNSKEY leads to trust in signatures made by an unrelated DNSKEY in the same zone.\n\nDetails\n\nverify_dnskey_rrset() will return Ok(true) if any record's public key matches a trust anchor. This results in verify_rrset() returning a Secure proof. This ultimately results in successfully verifying a response containing DNSKEY records. verify_default_rrset() looks up DNSKEY records by calling handle.lookup(), which takes the above code path. There's a comment following this that says \"DNSKEYs were already validated by the inner query in the above lookup\", but this is not the case. To fully verify the whole RRset of DNSKEYs, it would be necessary to check self-signatures by the trusted key over the other keys. Later in verify_default_rrset(), verify_rrset_with_dnskey() is called multiple times with different keys and signatures, and if any call succeeds, then its Proof is returned.\n\nSimilarly, verify_dnskey_rrset() returns Ok(false) if any DNSKEY record is covered by a DS record. A comment says \"If all the keys are valid, then we are secure\", but this is only checking that one key is authenticated by a DS in the parent zone's delegation point. This time, after control flow returns to verify_rrset(), it will call verify_default_rrset(). The special handling for DNSKEYs in verify_default_rrset() will then call verify_rrset_with_dnskey() using each KSK DNSKEY record, and if one call succeeds, return its Proof. If there are multiple KSK DNSKEYs in the RRset, then this leads to another authentication break. We need to either pass the authenticated DNSKEYs from the DS covering check to the RRSIG validation, or we need to perform this RRSIG validation of the DNSKEY RRset inside verify_dnskey_rrset() and cut verify_default_rrset() out of DNSKEY RRset validation entirely.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Hickory DNS failure to verify self-signed RRSIG for DNSKEYs","id":"GHSA-v7pc-74h8-xq2h","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"security_feature_bypass","year":"2025"},"n_packages":5,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.25.0-alpha.5"],"introduced":["0.25.0-alpha.1"],"last_affected":[],"package":"hickory-proto","purl":null,"source":"GHSA-v7pc-74h8-xq2h"},{"ecosystem":"crates.io","fixed":["0.25.0-alpha.5"],"introduced":["0.25.0-alpha.1"],"last_affected":[],"package":"hickory-proto","purl":"pkg:cargo/hickory-proto","source":"GHSA-v7pc-74h8-xq2h"},{"ecosystem":"crates.io","fixed":["0.24.3","0.25.0-alpha.5"],"introduced":["0.8.0","0.25.0-0"],"last_affected":[],"package":"hickory-proto","purl":"pkg:cargo/hickory-proto","source":"RUSTSEC-2025-0006"},{"ecosystem":"crates.io","fixed":["0.24.3"],"introduced":["0.8.0"],"last_affected":[],"package":"hickory-proto","purl":null,"source":"GHSA-v7pc-74h8-xq2h"},{"ecosystem":"crates.io","fixed":["0.24.3"],"introduced":["0.8.0"],"last_affected":[],"package":"hickory-proto","purl":"pkg:cargo/hickory-proto","source":"GHSA-v7pc-74h8-xq2h"}],"products":null,"published":"2025-02-07","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can bypass DNSSEC validation by exploiting trust anchor logic, allowing them to spoof DNS responses and redirect traffic.","url":"https://insights.sbomify.com/GHSA-v7pc-74h8-xq2h/"}