What’s Vulnerable › Vulnerabilities

CVE-2023-50868

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 74.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-02-14 · updated 2026-06-17
• Weakness: CWE-400

Description

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

Affected products

• Debian Linux: 10.0, 11.0
• Fedoraproject Fedora: 38, 39
• ISC BIND: from 9.0.0 before 9.16.48; from 9.9.3 before 9.16.48; from 9.18.0 before 9.18.24; from 9.18.11 before 9.18.24; from 9.19.0 before 9.19.21 — fixed in 9.16.48, 9.18.24, 9.19.21
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• NetApp Bootstrap Os: all versions
• NetApp Hci Baseboard Management Controller: all versions
• PowerDNS Recursor: before 4.8.5; from 4.9.0 before 4.9.3; from 5.0.0 before 5.0.2 — fixed in 4.8.5, 4.9.3, 5.0.2
• Red Hat Enterprise Linux: 6.0, 7.0, 8.0, 8.2, 8.4

How to fix

Upgrade to a fixed version: ISC BIND 9.16.48, 9.18.24, 9.19.21; PowerDNS Recursor 4.8.5, 4.9.3, 5.0.2. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2024/02/16/2
• http://www.openwall.com/lists/oss-security/2024/02/16/3
• https://access.redhat.com/security/cve/CVE-2023-50868
• https://bugzilla.suse.com/show_bug.cgi?id=1219826
• https://datatracker.ietf.org/doc/html/rfc5155
• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html
• https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1
• https://kb.isc.org/docs/cve-2023-50868
• https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html
• https://lists.debian.org/debian-lts-announce/2024/05/msg00011.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/

Get alerted when CVE-2023-50868 or the next vulnerability affects your stack