Threats tagged 'ghsa-qhmp-q7xh-99rh'

CoreDNS versions prior to 1.14.3 have a vulnerability in the tsig plugin where TSIG authentication can be bypassed on encrypted transports such as DoT, DoH, DoH3, DoQ, and gRPC. This occurs because these transports do not properly verify TSIG signatures and instead trust the transport writer's TsigStatus(), which always returns nil, allowing unauthenticated clients to bypass TSIG-based access controls.