CVE-2023-50868

bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources

View on CVE.org
Published Feb 14, 2024 CVSS 3.1 · 7.5 High EPSS 74.3% KEV · Not listed
Description
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-3736-1 unbound security update
Debian DLA Debian DLA DLA-3816-1 bind9 security update
Debian DLA Debian DLA DLA-3859-1 systemd security update
Debian DLA Debian DLA DLA-3974-1 dnsmasq security update
Debian DSA Debian DSA DSA-5620-1 unbound security update
Debian DSA Debian DSA DSA-5621-1 bind9 security update
Debian DSA Debian DSA DSA-5626-1 pdns-recursor security update
Debian DSA Debian DSA DSA-5633-1 knot-resolver security update
Ubuntu USN Ubuntu USN USN-6633-1 Bind vulnerabilities
Ubuntu USN Ubuntu USN USN-6642-1 Bind vulnerabilities
Ubuntu USN Ubuntu USN USN-6657-1 Dnsmasq vulnerabilities
Ubuntu USN Ubuntu USN USN-6657-2 Dnsmasq vulnerabilities
Ubuntu USN Ubuntu USN USN-6665-1 Unbound vulnerabilities
Ubuntu USN Ubuntu USN USN-6723-1 Bind vulnerabilities
Ubuntu USN Ubuntu USN USN-8946-1 Unbound vulnerabilities
References
Link Providers
http://www.openwall.com/lists/oss-security/2024/02/16/2 cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2024/02/16/3 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2023-50868 cve-icon cve-icon
https://blog.powerdns.com/2024/02/13/powerdns-recursor-4-8-6-4-9-3-5-0-2-released cve-icon
https://bugzilla.suse.com/show_bug.cgi?id=1219826 cve-icon cve-icon
https://datatracker.ietf.org/doc/html/rfc5155 cve-icon cve-icon
https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html cve-icon cve-icon
https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 cve-icon cve-icon
https://kb.isc.org/docs/cve-2023-50868 cve-icon cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2024/05/msg00011.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2024/09/msg00001.html cve-icon
https://lists.debian.org/debian-lts-announce/2024/11/msg00035.html cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/ cve-icon
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html cve-icon cve-icon
https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-50868 cve-icon
https://security.netapp.com/advisory/ntap-20240307-0008/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-50868 cve-icon
https://www.isc.org/blogs/2024-bind-security-release/ cve-icon cve-icon
https://www.knot-resolver.cz/2024-02-13-knot-resolver-5.7.1.html cve-icon
History
Type Values Removed Values Added
First Time appeared Debian
Debian debian Linux
Fedoraproject
Fedoraproject fedora
Isc
Isc bind
Netapp
Netapp active Iq Unified Manager
Netapp bootstrap Os
Netapp h300s
Netapp h410c
Netapp h410s
Netapp h500s
Netapp h700s
Netapp hci Baseboard Management Controller
Netapp hci Compute Node
Powerdns
Powerdns recursor
CPEs cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*
cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*
cpe:2.3:a:isc:bind:*:s1:*:*:supported_preview:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:hci_baseboard_management_controller:-:*:*:*:*:*:*:*
cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.4:*:*:*:*:*:*:*
Vendors & Products Debian
Debian debian Linux
Fedoraproject
Fedoraproject fedora
Isc
Isc bind
Netapp
Netapp active Iq Unified Manager
Netapp bootstrap Os
Netapp h300s
Netapp h410c
Netapp h410s
Netapp h500s
Netapp h700s
Netapp hci Baseboard Management Controller
Netapp hci Compute Node
Powerdns
Powerdns recursor
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
Metrics epss

{'score': 0.48504}

 epss

{'score': 0.62382}
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}
Type Values Removed Values Added
CPEs cpe:/o:redhat:rhel_els:6
Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
Earlier changes (3)
Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Nov 4, 2025, 6:20 PM
Reserved
Dec 14, 2023, 12:00 AM

View source JSON

Updated
Nov 4, 2025, 6:20 PM

JSON

Status
Analyzed
Published
Feb 14, 2024, 4:15 PM
Modified
Jun 17, 2026, 6:40 AM

View source JSON

Severity
Important
Public date
Feb 13, 2024, 12:00 AM

View source Bugzilla JSON

No data.