- Reported
-
- Issued
-
- Package
-
hickory-net
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#dns
#dnssec
#nsec
- Aliases
-
- References
-
- Patched
-
Description
When an NSEC record's next domain name is below the queried name, the queried name exists as an empty non-terminal (RFC 8020 section 3.1). The NSEC validator did not check for this case and accepted an NXDOMAIN response backed by such a record as secure.
The response code is not covered by any signature. An attacker who can modify DNS responses can take a genuine signed NODATA response for an empty non-terminal, change its response code to NXDOMAIN, and have the validator accept that an existing name does not exist.
This affects DNSSEC validation through DnssecDnsHandle when built with dnssec-ring or dnssec-aws-lc-rs.
The fix rejects NXDOMAIN as bogus, and validates NODATA as secure, when the covering NSEC record's next domain name is below the queried name and is not the zone apex. It is in 0.26.2.
Advisory available under CC0-1.0
license.