PT-2019-15812 · Cz.Nic+2 · Knot Resolver+2

Published 2019-12-16 · Updated 2024-10-01 · CVE-2019-19331

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions knot-resolver versions prior to 4.3.0

Description The issue allows for denial of service through high CPU utilization. This occurs when DNS replies contain a large number of resource records, which can be processed inefficiently. In extreme cases, processing a single uncached message can take several CPU seconds. For example, a DNS message can contain a few thousand A records, with a limit of 64kB.

Recommendations For versions prior to 4.3.0, update to version 4.3.0 or later to resolve the issue. As a temporary workaround, consider restricting the size of DNS messages or limiting the number of resource records processed to minimize the risk of high CPU utilization.

Exploit

Fix

DoS

Improper Resource Release

Weakness Enumeration

CWE-404

CWE-407

Related Identifiers

CVE-2019-19331

DLA-3795-1

USN-7047-1

Affected Products

Linuxmint

Ubuntu

Knot Resolver

References · 26

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19331 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19331 · Vendor Advisory
• https://knot-resolver.cz/2019-12-04-knot-resolver-4.3.0.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12667 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-19331 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10190 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19331 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7047-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19331 · Security Note
• https://osv.dev/vulnerability/DLA-3795-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19331 · Security Note
• https://ubuntu.com/security/CVE-2019-10191 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12667 · Security Note
• https://ubuntu.com/security/CVE-2019-19331 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10190 · Vendor Advisory