CVE-2019-19331: High severity nic Knot Resolver vulnerability
knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/knot-resolverto a version that resolves this vulnerability.Fixed in 5.3.1-1+deb11u1Fixed in 5.6.0-1+deb12u1Fixed in 5.7.4-2 - Upgrade
Upgrade
alpine/knot-resolverto a version that resolves this vulnerability.Fixed in 4.3.0-r0 - Upgrade
Upgrade
knot-resolverto a version that resolves this vulnerability.Fixed in 4.3.0
Event History
Frequently Asked Questions
What is CVE-2019-19331?
CVE-2019-19331 is a vulnerability in knot-resolver before version 4.3.0 that can be exploited to cause denial of service through high CPU utilization.
How severe is CVE-2019-19331?
CVE-2019-19331 has a severity rating of high with a CVSS score of 7.5.
Which software versions are affected by CVE-2019-19331?
Versions of knot-resolver up to, but not including, 4.3.0 are affected by CVE-2019-19331.
How can CVE-2019-19331 be exploited?
CVE-2019-19331 can be exploited by sending DNS replies with a large number of resource records, causing inefficient processing and high CPU utilization.
How can I fix CVE-2019-19331?
To fix CVE-2019-19331, upgrade knot-resolver to version 4.3.0 or later.