go-resolver vulnerable to attacker-controlled domains due to unvalidated RRSIG RRs
High severity
GitHub Reviewed
Published
Dec 28, 2022
to the GitHub Advisory Database
•
Updated Jan 23, 2024
Description
Published by the National Vulnerability Database
Dec 28, 2022
Published to the GitHub Advisory Database
Dec 28, 2022
Reviewed
Dec 29, 2022
Last updated
Jan 23, 2024
go-resolver's DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The owner name of RRSIG RRs is not validated, permitting an attacker to present the RRSIG for an attacker-controlled domain in a response for any other domain.
References