GHSA-8459-gg55-8qjj
Record from GitHub Advisory Database · Published February 14, 2024
Certain DNSSEC aspects of the DNS protocol (in RFC 4035 and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses when there is a zone with many DNSKEY and RRSIG records, aka the "KeyTrap" issue. The protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| bind | Wolfi | 9.18.24-r0 |
| bind | Chainguard | 9.18.24-r0 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| wolfi | bind | 0 |
| chainguard | bind | 0 |
Timeline
- Feb 14, 2024 CVE Published
- Apr 10, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-8459-gg55-8qjj
vulnetix vdb fixes GHSA-8459-gg55-8qjjOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-8459-gg55-8qjj/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7 url
- https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html url
- https://news.ycombinator.com/item?id=39367411 url
- https://news.ycombinator.com/item?id=39372384 url
- https://security.netapp.com/advisory/ntap-20240307-0007 url
- https://www.athene-center.de/aktuelles/key-trap url
- https://www.securityweek.com/keytrap-dns-attack-could-disable-large-parts-of-internet-researchers url
- https://www.theregister.com/2024/02/13/dnssec_vulnerability_internet url
- https://bugzilla.suse.com/show_bug.cgi?id=1219823 url
- https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html url
- https://kb.isc.org/docs/cve-2023-50387 url
- https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html url
- https://lists.debian.org/debian-lts-announce/2024/11/msg00035.html url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6 url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP url
…and 18 more