CVE-2024-25638

Published: Jul 22, 2024Modified: Jun 17, 2026Deferred

8.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

Exploitability: 2.2 / Impact: 6.0

Source: security-advisories@github.com (Secondary)

Description

dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.

Related CWEs

CWE-345

Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

CWE-349

Acceptance of Extraneous Untrusted Data With Trusted Data

The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.

References (4)

https://github.com/dnsjava/dnsjava/commit/2073a0cdea2c560465f7ac0cc56f202e6fc39705

Source: security-advisories@github.com

https://github.com/dnsjava/dnsjava/security/advisories/GHSA-cfxw-4h78-h7fw

Source: security-advisories@github.com

https://github.com/dnsjava/dnsjava/commit/bc51df1c455e6c9fb7cbd42fcb6d62d16047818d

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/dnsjava/dnsjava/security/advisories/GHSA-cfxw-4h78-h7fw

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.