Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

dnsjava:dnsjava

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.0MavenPublished

    DNSJava DNSSEC Bypass

    CVE-2024-25638 · GHSA-cfxw-4h78-h7fw

    Affected
    • Maven dnsjava:dnsjava < 3.6.0
    Fixed in
    3.6.0· Vendor fix available
    Issue
    Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. Details DNS Messages are not authenticated. They do not guarantee that - received RRs are authentic - not received RRs do not exist - all or any received records in a response relate to the request Applications utilizing DNSSEC generally expect these guarantees to be met, however DNSSEC by itself only guarantees the first two. To meet the third guarantee, resolvers generally follow an (undocumented, as far as RFCs go) algorithm such as: (simplified, e.g. lacks DNSSEC validation!) 1. denote by QNAME the name you are querying (e.g. fraunhofer.de.), and initialize a list of aliases 2. if the ANSWER section contains a valid PTR RRSet for QNAME, return it (and optionally return the list of aliases as well) 3. if the ANSWER section contains a valid CNAME RRSet for QNAME, add it to the list of aliases. Set QNAME to the CNAME's target and go to 2. 4.…

    Recommended action: Upgrade to 3.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →