CVE-2019-19331
Last modified
CVE-2019-19331 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. EPSS estimates a 2.17% chance of exploitation in the next 30 days.
Description
knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nic | Knot Resolver | < 4.3.0 |
| Debian | Debian Linux | 10.0 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19331Exploit, Issue Tracking, Patch
- https://www.knot-resolver.cz/2019-12-04-knot-resolver-4.3.0.htmlRelease Notes, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19331Exploit, Issue Tracking, Patch
- https://www.knot-resolver.cz/2019-12-04-knot-resolver-4.3.0.htmlRelease Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-19331?
How severe is CVE-2019-19331?
How do I fix CVE-2019-19331?
Are you affected by CVE-2019-19331?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST