Threats tagged 'ghsa-rp29-c6r7-8r7c'

Hickory DNS versions hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 have a DNSSEC validation bypass vulnerability. The function verify_rrsets() incorrectly ignores the DNS class when partitioning resource record sets (RRsets), causing non-IN class records to skip signature verification while still being marked as secure if the IN records verify correctly. This flaw allows attackers who can supply DNS responses to include forged CH or HS class records, including DS records, to authenticate arbitrary DNSKEYs and forge child zone responses.