CVE-2017-11104

Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set, because of an improper TSIG validity period check.

• CWE-20

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00076.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00078.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00089.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00049.htmlBroken Link
• http://www.debian.org/security/2017/dsa-3910Third Party Advisory
• http://www.securityfocus.com/bid/99598Broken Link
• http://www.synacktiv.ninja/ressources/Knot_DNS_TSIG_Signature_Forgery.pdfExploit, Mitigation, Patch, Third Party Advisory
• https://bugs.debian.org/865678Issue Tracking, Third Party Advisory
• https://lists.nic.cz/pipermail/knot-dns-users/2017-June/001144.htmlBroken Link, Mailing List, Patch, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00076.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00078.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00089.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00049.htmlBroken Link
• http://www.debian.org/security/2017/dsa-3910Third Party Advisory
• http://www.securityfocus.com/bid/99598Broken Link
• http://www.synacktiv.ninja/ressources/Knot_DNS_TSIG_Signature_Forgery.pdfExploit, Mitigation, Patch, Third Party Advisory
• https://bugs.debian.org/865678Issue Tracking, Third Party Advisory
• https://lists.nic.cz/pipermail/knot-dns-users/2017-June/001144.htmlBroken Link, Mailing List, Patch, Third Party Advisory

Published

Jul 8, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-11099When SWFTools 0.9.2 processes a crafted file in wav2swf, it …
• CVE-2017-1110IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 c…
• CVE-2017-11100When SWFTools 0.9.2 processes a crafted file in swfextract, …
• CVE-2017-11101When SWFTools 0.9.2 processes a crafted file in swfcombine, …
• CVE-2017-11102The ReadOneJNGImage function in coders/png.c in GraphicsMagi…
• CVE-2017-11103Heimdal before 7.4 allows remote attackers to impersonate se…8.1
• CVE-2017-11105The OnePlus 2 Primary Bootloader (PBL) does not validate the…
• CVE-2017-11107phpLDAPadmin through 1.2.3 has XSS in htdocs/entry_chooser.p…6.1
• CVE-2017-11108tcpdump 4.9.0 allows remote attackers to cause a denial of s…
• CVE-2017-11109Vim 8.0 allows attackers to cause a denial of service (inval…
• CVE-2017-11110The ole_init function in ole.c in catdoc 0.95 allows remote …
• CVE-2017-11111In Netwide Assembler (NASM) 2.14rc0, preproc.c allows remote…