CVE-2019-19331
First published: Mon Dec 16 2019(Updated: )
knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/knot-resolver | 5.3.1-1+deb11u1 5.6.0-1+deb12u1 5.7.4-2 | |
| Go-resolver | <4.3.0 | |
| Debian | =10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19331
- https://www.knot-resolver.cz/2019-12-04-knot-resolver-4.3.0.html
- https://lists.debian.org/debian-lts-announce/2024/04/msg00017.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19331
- https://nvd.nist.gov/vuln/detail/CVE-2019-19331
- https://launchpad.net/bugs/cve/CVE-2019-19331
- https://security-tracker.debian.org/tracker/CVE-2019-19331
- https://ubuntu.com/security/CVE-2019-19331
- https://www.openwall.com/lists/oss-security/2019/12/04/4
Frequently Asked Questions
What is CVE-2019-19331?
CVE-2019-19331 is a vulnerability in knot-resolver before version 4.3.0 that can be exploited to cause denial of service through high CPU utilization.
How severe is CVE-2019-19331?
CVE-2019-19331 has a severity rating of high with a CVSS score of 7.5.
Which software versions are affected by CVE-2019-19331?
Versions of knot-resolver up to, but not including, 4.3.0 are affected by CVE-2019-19331.
How can CVE-2019-19331 be exploited?
CVE-2019-19331 can be exploited by sending DNS replies with a large number of resource records, causing inefficient processing and high CPU utilization.
How can I fix CVE-2019-19331?
To fix CVE-2019-19331, upgrade knot-resolver to version 4.3.0 or later.
- agent/type
- agent/weakness
- agent/remedy
- agent/severity
- agent/first-publish-date
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/launchpad-cve
- source/Launchpad
- agent/references
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- collector/usn-cve
- source/Ubuntu
- agent/event
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/nvd-api
- package-manager/debian
- vendor/nic
- canonical/go-resolver
- vendor/debian
- canonical/debian
- version/debian/10.0