# GHSA-v7pc-74h8-xq2h: Hickory DNS failure to verify self-signed RRSIG for DNSKEYs > Attackers can bypass DNSSEC validation by exploiting trust anchor logic, allowing them to spoof DNS responses and redirect traffic. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 7 Feb 2025 - **Also known as:** RUSTSEC-2025-0006 ## What is GHSA-v7pc-74h8-xq2h? GHSA-v7pc-74h8-xq2h is a vulnerability in hickory-proto, published on 7 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description Summary The DNSSEC validation routines treat entire RRsets of DNSKEY records as trusted once they have established trust in only one of the DNSKEYs. As a result, if a zone includes a DNSKEY with a public key that matches a configured trust anchor, all keys in that zone will be trusted to authenticate other records in the zone. There is a second variant of this vulnerability involving DS records, where an authenticated DS record covering one DNSKEY leads to trust in signatures made by an unrelated DNSKEY in the same zone. Details verify_dnskey_rrset() will return Ok(true) if any record's public key matches a trust anchor. This results in verify_rrset() returning a Secure proof. This ultimately results in successfully verifying a response containing DNSKEY records. verify_default_rrset() looks up DNSKEY records by calling handle.lookup(), which takes the above code path. There's a comment following this that says "DNSKEYs were already validated by the inner query in the above lookup", but this is not the case. To fully verify the whole RRset of DNSKEYs, it would be necessary to check self-signatures by the trusted key over the other keys. Later in verify_default_rrset(), verify_rrset_with_dnskey() is called multiple times with different keys and signatures, and if any call succeeds, then its Proof is returned. Similarly, verify_dnskey_rrset() returns Ok(false) if any DNSKEY record is covered by a DS record. A comment says "If all the keys are valid, then we are secure", but this is only checking that one key is authenticated by a DS in the parent zone's delegation point. This time, after control flow returns to verify_rrset(), it will call verify_default_rrset(). The special handling for DNSKEYs in verify_default_rrset() will then call verify_rrset_with_dnskey() using each KSK DNSKEY record, and if one call succeeds, return its Proof. If there are multiple KSK DNSKEYs in the RRset, then this leads to another authentication break. We need to either pass the authenticated DNSKEYs from the DS covering check to the RRSIG validation, or we need to perform this RRSIG validation of the DNSKEY RRset inside verify_dnskey_rrset() and cut verify_default_rrset() out of DNSKEY RRset validation entirely. ## Which versions are affected by GHSA-v7pc-74h8-xq2h? 5 open source packages ship an affected version, including hickory-proto. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `hickory-proto` | crates.io | From 0.25.0-alpha.1 | 0.25.0-alpha.5 | | `hickory-proto` | crates.io | From 0.25.0-alpha.1 | 0.25.0-alpha.5 | | `hickory-proto` | crates.io | From 0.8.0 | 0.24.3, 0.25.0-alpha.5 | | `hickory-proto` | crates.io | From 0.8.0 | 0.24.3 | | `hickory-proto` | crates.io | From 0.8.0 | 0.24.3 | ## How do I fix GHSA-v7pc-74h8-xq2h? Upgrade hickory-proto to a fixed version for your release line: 0.25.0-alpha.5 or 0.24.3. ## Is GHSA-v7pc-74h8-xq2h being exploited? There is no known exploitation of GHSA-v7pc-74h8-xq2h in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for GHSA-v7pc-74h8-xq2h and fix it if it is affected. What it is: GHSA-v7pc-74h8-xq2h is a vulnerability in hickory-proto, published on 7 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: There is no known exploitation of GHSA-v7pc-74h8-xq2h in the wild and no public exploit code. Affected packages and fixed versions: - hickory-proto (crates.io): affected from 0.25.0-alpha.1; fixed in 0.25.0-alpha.5 - hickory-proto (crates.io): affected from 0.25.0-alpha.1; fixed in 0.25.0-alpha.5 - hickory-proto (crates.io): affected from 0.8.0; fixed in 0.24.3, 0.25.0-alpha.5 - hickory-proto (crates.io): affected from 0.8.0; fixed in 0.24.3 - hickory-proto (crates.io): affected from 0.8.0; fixed in 0.24.3 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/GHSA-v7pc-74h8-xq2h/ (Markdown: https://insights.sbomify.com/GHSA-v7pc-74h8-xq2h/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/GHSA-v7pc-74h8-xq2h --- From sbomify Insights: https://insights.sbomify.com/GHSA-v7pc-74h8-xq2h/ Summaries are generated and may contain mistakes; the official description above is the record.