CVE-2023-50387

Published: Feb 14, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Affected (21)

Products: Redhat: Enterprise Linux · Microsoft: Windows Server 2008, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2022 23h2 · Fedoraproject: Fedora · +5 more

Show all products

1 product

6 products

Windows Server 2022 23h2

1 product

1 product

1 product

1 product

1 product

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 9.0

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Microsoft Windows Server 2008	Version r2 sp1
Microsoft Windows Server 2012	All versions
Microsoft Windows Server 2012	Version r2
Microsoft Windows Server 2016	All versions
Microsoft Windows Server 2019	All versions
Microsoft Windows Server 2022	All versions
Microsoft Windows Server 2022 23h2	All versions

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 39

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Thekelleys Dnsmasq	Before 2.90

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Nic Knot Resolver	Before 5.71

Configuration F

3 vulnerable

Vulnerable Software	Affected Versions
Powerdns Recursor	From 4.8.0 to 4.8.6
Powerdns Recursor	From 4.9.0 to 4.9.3
Powerdns Recursor	From 5.0.0 to 5.0.2

Configuration G

3 vulnerable

Vulnerable Software	Affected Versions
Isc Bind	From 9.0.0 to 9.16.46
Isc Bind	From 9.18.0 to 9.18.22
Isc Bind	From 9.19.0 to 9.19.20

Configuration H

1 vulnerable

Vulnerable Software	Affected Versions
Nlnetlabs Unbound	Before 1.19.1

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (66)

http://www.openwall.com/lists/oss-security/2024/02/16/2

Source: cve@mitre.org

Mailing List

http://www.openwall.com/lists/oss-security/2024/02/16/3

Source: cve@mitre.org

Mailing List

https://access.redhat.com/security/cve/CVE-2023-50387

Source: cve@mitre.org

Third Party Advisory

https://bugzilla.suse.com/show_bug.cgi?id=1219823

Source: cve@mitre.org

Issue Tracking

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html

Source: cve@mitre.org

Third Party Advisory

https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1

Source: cve@mitre.org

Patch

https://kb.isc.org/docs/cve-2023-50387

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html

Source: cve@mitre.org

https://lists.debian.org/debian-lts-announce/2024/05/msg00011.html

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/

Source: cve@mitre.org

https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-50387

Source: cve@mitre.org

PatchVendor Advisory

https://news.ycombinator.com/item?id=39367411

Source: cve@mitre.org

Third Party Advisory

https://news.ycombinator.com/item?id=39372384

Source: cve@mitre.org

Issue Tracking

https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/

Source: cve@mitre.org

Vendor Advisory

https://security.netapp.com/advisory/ntap-20240307-0007/

Source: cve@mitre.org

https://www.athene-center.de/aktuelles/key-trap

Source: cve@mitre.org

Third Party Advisory

https://www.athene-center.de/fileadmin/content/PDF/Technical_Report_KeyTrap.pdf

Source: cve@mitre.org

Technical DescriptionThird Party Advisory

https://www.isc.org/blogs/2024-bind-security-release/

Source: cve@mitre.org

Third Party Advisory

https://www.securityweek.com/keytrap-dns-attack-could-disable-large-parts-of-internet-researchers/

Source: cve@mitre.org

Press/Media CoverageThird Party Advisory

https://www.theregister.com/2024/02/13/dnssec_vulnerability_internet/

Source: cve@mitre.org

PatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2024/02/16/2