PT-2018-9195 · Cz.Nic · Knot Resolver

Published 2018-01-22 · Updated 2019-11-06 · CVE-2018-1000002

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: Knot Resolver versions prior to 1.5.2

Description: The issue is related to improper input validation bugs in DNSSEC validators components. This allows an attacker in a man-in-the-middle position to deny the existence of some data in DNS via packet replay.

Recommendations: For versions prior to 1.5.2, update to version 1.5.2 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-1000002

Affected Products

Knot Resolver

References · 5

• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000002 · Security Note
• https://knot-resolver.cz/2018-01-22-knot-resolver-1.5.2.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-1000002 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000002 · Vendor Advisory