REDHAT-BUG-2538208: High severity crates.io/hickory-resolver vulnerability
hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookupip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hickory-resolverto a version that resolves this vulnerability.Fixed in 0.26.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using hickory-resolver versions earlier than 0.26.2 are exposed when they rely on Resolver::lookup() or Resolver::lookup_ip() and expect DNSSEC validation to reject invalid records.
What capabilities does an attacker need to exploit this issue?
An attacker must control the answering DNS zone or be positioned on the network path. They can then cause forged DNS records to be returned as successful, apparently validated results.
How can I determine whether my application is affected?
Check whether it uses crates.io/hickory-resolver before version 0.26.2 and calls Resolver::lookup() or Resolver::lookup_ip(). The issue affects propagation of bogus DNSSEC proof states through those APIs.
What is the available remediation?
Update hickory-resolver to version 0.26.2 or later. The provided data does not identify a workaround for deployments that cannot update immediately.