Vulnerability

CVE-2024-25638

 Report advisory or correction

CVSS Score 9.2 critical

CVSS Vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

CWE

CWE-345

References

https://github.com/dnsjava/dnsjava/security/advisories/GHSA-cfxw-4h78-h7fw
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-25638

[CVE-2024-25638] CWE-345: Insufficient Verification of Data Authenticity

Description

dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.

See dnsjava/dnsjava package information