x/vulndb: potential Go vuln in gitlab.nic.cz/knot/knot-resolver: CVE-2023-50868

[GoVulnBot]

CVE-2023-50868 references gitlab.nic.cz/knot/knot-resolver, which may be a Go module.

Description:
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-50868
• JSON: https://github.com/CVEProject/cvelist/tree/75d2e2d970a7e62ffa5e9210bb81154a6a86baf0/2023/50xxx/CVE-2023-50868.json
• web: https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/
• web: https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html
• web: https://www.isc.org/blogs/2024-bind-security-release/
• web: https://datatracker.ietf.org/doc/html/rfc5155
• web: https://kb.isc.org/docs/cve-2023-50868
• web: https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1
• web: https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html
• Imported by: https://pkg.go.dev/gitlab.nic.cz/knot/knot-resolver?tab=importedby

Cross references:

• Module gitlab.nic.cz/knot/knot-resolver appears in issue x/vulndb: potential Go vuln in gitlab.nic.cz/knot/knot-resolver: CVE-2023-46317 #2149 NOT_GO_CODE

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: gitlab.nic.cz/knot/knot-resolver
      vulnerable_at: 6.0.6+incompatible
      packages:
        - package: n/a
cves:
    - CVE-2023-50868
references:
    - web: https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/
    - web: https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html
    - web: https://www.isc.org/blogs/2024-bind-security-release/
    - web: https://datatracker.ietf.org/doc/html/rfc5155
    - web: https://kb.isc.org/docs/cve-2023-50868
    - web: https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1
    - web: https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html

[gopherbot]

Change https://go.dev/cl/568036 mentions this issue: data/excluded: batch add 23 excluded reports