Threats tagged 'ghsa-p25q-gxfm-cmhr'

A vulnerability in Hickory DNS validating recursor versions 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2 allows caching of DNSSEC-bogus answers with an attacker-controlled TTL up to 24 hours. This occurs because the recursor uses the untrusted TTL from the attacker-supplied record instead of a short validation-failure TTL. An attacker can exploit this by spoofing an authoritative response with an invalid signature and a long TTL, causing the bogus result to be cached for up to 24 hours.