Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

trust-dns-server

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    trust-dns vulnerable to Remote Attackers causing Denial-of-Service (packet loops) with crafted DNS packets

    GHSA-5fm9-h728-fwpj

    Affected
    • crates.io trust-dns-server < 0.22.1; >= 0.23.0-alpha.2, < 0.23.0-alpha.3
    Fixed in
    0.22.10.23.0-alpha.3· Vendor fix available
    Issue
    trust-dns and trust-dns-server are vulnerable to remotely triggered denial-of-service attacks, consuming both network and CPU resources. DNS messages with the QR=1 bit set are responded to with a FormErr response. This allows creating a traffic loop, in which these FormErr responses are sent nonstop between vulnerable servers. There are two scenarios how this can be exploited: 1) Create a loop between two instances of trust-dns, consuming network resources, or 2) consuming the CPU of a single instance. With two instances A and B an attacker sends a DNS query with a spoofed source IP address to A. A replies with a FormErr to B. Now both servers with ping-pong the message back and forth until by chance the packet is dropped in the network. Multiple spoofed packets can be sent by the attacker, increasing resource consumption. A single server can get locked up replying to itself. Same setup as above, but now A sends the reply to itself. The packet is sent out as fast as the CPU and…

    Recommended action: Upgrade to 0.23.0-alpha.3 (pre-release) or 0.22.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 7.5crates.ioPublished

    Stack consumption in trust-dns-server

    CVE-2020-35857 · GHSA-4cww-f7w5-x525

    Affected
    • crates.io trust-dns-server >= 0.16.0, < 0.18.1
    Fixed in
    0.18.1· Vendor fix available
    Issue
    There's a stack overflow leading to a crash and potential DOS when processing additional records for return of MX or SRV record types from the server. This is only possible when a zone is configured with a null target for MX or SRV records. Prior to 0.16.0 the additional record processing was not supported by trust-dns-server. There Are no known issues with upgrading from 0.16 or 0.17 to 0.18.1. The remidy should be to upgrade to 0.18.1. If unable to do so, MX, SRV or other record types with a target to the null type, should be avoided.

    Recommended action: Upgrade to 0.18.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →