Threats tagged 'ghsa-h7hc-rhv6-hvw6'

Hickory DNS versions hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 have a DNSSEC validation bypass vulnerability. The validator incorrectly verifies RRSIG signatures against the DNSKEY of the name in the Signer's Name field without confirming that this name matches the zone of the RRset. This flaw allows attackers controlling any secure zone to create valid signatures over arbitrary records in unrelated zones, causing resolvers and clients to accept forged DNS data as authentic.