Back to feed
EUVD-2022-7669 · Published Dec 28, 2022
go-resolver's DNSSEC validation not performed correctly go-resolver's DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. Root DNSSEC public keys are not validated, permitting an attacker to present a self-signed root key and delegation chain.
Technologies
Go-Resolver_Project Go-ResolverPeterzen Goresolver
Weaknesses
CWE-345CWE-347
CVSS scores
- v3.17.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Resource Development Initial Access Persistence Stealth Defense Impairment Credential Access Collection Impact
References
Potentially impacted assets
See if this affects your attack surface
