x/vulndb: potential Go vuln in gitlab.nic.cz/knot/knot-resolver: CVE-2023-50387

[GoVulnBot]

CVE-2023-50387 references gitlab.nic.cz/knot/knot-resolver, which may be a Go module.

Description:
Certain DNSSEC aspects of the DNS protocol (in RFC 4035 and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses when there is a zone with many DNSKEY and RRSIG records, aka the "KeyTrap" issue. The protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-50387
• JSON: https://github.com/CVEProject/cvelist/tree/75d2e2d970a7e62ffa5e9210bb81154a6a86baf0/2023/50xxx/CVE-2023-50387.json
• web: https://datatracker.ietf.org/doc/html/rfc4035
• web: https://www.athene-center.de/aktuelles/key-trap
• web: https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/
• web: https://kb.isc.org/docs/cve-2023-50387
• web: https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html
• web: https://www.theregister.com/2024/02/13/dnssec_vulnerability_internet/
• web: https://news.ycombinator.com/item?id=39367411
• web: https://www.securityweek.com/keytrap-dns-attack-could-disable-large-parts-of-internet-researchers/
• web: https://www.isc.org/blogs/2024-bind-security-release/
• web: https://news.ycombinator.com/item?id=39372384
• web: https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1
• web: https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html
• Imported by: https://pkg.go.dev/gitlab.nic.cz/knot/knot-resolver?tab=importedby

Cross references:

• Module gitlab.nic.cz/knot/knot-resolver appears in issue x/vulndb: potential Go vuln in gitlab.nic.cz/knot/knot-resolver: CVE-2023-46317 #2149 NOT_GO_CODE

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: gitlab.nic.cz/knot/knot-resolver
      vulnerable_at: 6.0.6+incompatible
      packages:
        - package: n/a
cves:
    - CVE-2023-50387
references:
    - web: https://datatracker.ietf.org/doc/html/rfc4035
    - web: https://www.athene-center.de/aktuelles/key-trap
    - web: https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/
    - web: https://kb.isc.org/docs/cve-2023-50387
    - web: https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html
    - web: https://www.theregister.com/2024/02/13/dnssec_vulnerability_internet/
    - web: https://news.ycombinator.com/item?id=39367411
    - web: https://www.securityweek.com/keytrap-dns-attack-could-disable-large-parts-of-internet-researchers/
    - web: https://www.isc.org/blogs/2024-bind-security-release/
    - web: https://news.ycombinator.com/item?id=39372384
    - web: https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1
    - web: https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html

[gopherbot]

Change https://go.dev/cl/568036 mentions this issue: data/excluded: batch add 23 excluded reports