1 line
2.1 KiB
JSON
1 line
2.1 KiB
JSON
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0540","published":"2026-09-03T12:00:00Z","modified":"2026-11-13T12:55:54.316294846Z","aliases":["CVE-2026-123591","GHSA-7php-9j59-g3ch","RUSTSEC-2026-0531"],"summary":"Child-side NSEC or NSEC3 record accepted as proof that a delegation has no DS record","details":"To show that a delegation is insecure, a validator needs proof that the parent zone has no DS record for it. That proof must come from the parent side of the zone cut: RFC 4035 section 5.2, RFC 5155 section 8.9 and RFC 6840 section 4.4 require the matching NSEC or NSEC3 record not to have the SOA bit set, since a record with SOA comes from the child zone's apex.\n\nDNSSEC validation did not check this. An attacker who can answer or modify DNS responses can answer a DS query with the child zone's own signed NSEC or NSEC3 record for its apex, which does not list DS, and have the validator accept that the delegation is insecure. Records in the child zone can then be forged without any signature.\n\nThis affects DNSSEC validation through `DnssecDnsHandle` when built with `dnssec-ring` or `dnssec-aws-lc-rs`.\n\nThe fix treats a NODATA proof for a DS query as bogus when the directly matching NSEC or NSEC3 record has SOA in its type bitmap. It is in 0.26.2.","affected":[{"package":{"name":"hickory-net","ecosystem":"crates.io","purl":"pkg:cargo/hickory-net"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0540.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-net"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0540.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/ec98851f4d175d97b61701bc539523ff63ddbb00"}],"database_specific":{"license":"CC0-1.0"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}]} |