PT-2023-23330 · Lightbend · Lightbend Akka+1

Published 2023-05-11 · Updated 2025-01-27 · CVE-2023-31442

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Lightbend Akka versions 2.5.14 through 2.8.0 Akka Discovery versions 2.5.14 through 2.8.0

Description The async-dns resolver in Lightbend Akka uses predictable DNS transaction IDs when resolving DNS records, making DNS resolution subject to poisoning by an attacker. If the application performing discovery does not validate the authenticity of the discovered service, this may result in exfiltration of application data. For example, persistence events may be published to an unintended Kafka broker. If such validation is performed, then the poisoning constitutes a denial of access to the intended service.

Recommendations For versions 2.5.14 through 2.8.0, update to version 2.8.1 or later to resolve the issue. As a temporary workaround, consider validating the authenticity of discovered services via TLS to minimize the risk of exploitation. Restrict access to sensitive data and services to prevent potential exfiltration in case of DNS poisoning.

Fix

Related Identifiers

CVE-2023-31442

Affected Products

Akka Discovery

Lightbend Akka

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-31442 · Security Note
• https://akka.io/security/akka-async-dns-2023-31442.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-31442 · Vendor Advisory
• https://t.me/cvenotify/50932 · Telegram Post
• https://lightbend.com · Note
• https://t.me/cvenotify/50208 · Telegram Post
• https://t.me/cibsecurity/63856 · Telegram Post
• https://t.me/cvenotify/108694 · Telegram Post