CVE-2018-20994

Published: Aug 26, 2019Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled.

Affected (3)

Products: Trust Dns Proto Project: Trust Dns Proto

Trust Dns Proto Project

1 product

Trust Dns Proto

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Trust Dns Proto Project Trust Dns Proto	Before 0.4.3
Trust Dns Proto Project Trust Dns Proto	Version 0.5.0 alpha.1
Trust Dns Proto Project Trust Dns Proto	Version 0.5.0 alpha.2

Related CWEs

CWE-674

Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

References (2)

https://rustsec.org/advisories/RUSTSEC-2018-0007.html

Source: cve@mitre.org

Third Party Advisory

https://rustsec.org/advisories/RUSTSEC-2018-0007.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.