CVE-2021-40083 — Reachable Assertion in Knot Resolver

CWE-617 — Reachable Assertion5 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.8%
top 25.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cz.nic Knot-resolverNIC Knot Resolver
Timeline
PublishedAug 25
Latest updateMay 24

Description

Knot Resolver before 5.3.2 is prone to an assertion failure, triggerable by a remote attacker in an edge case (NSEC3 with too many iterations used for a positive wildcard proof).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDnic/knot_resolver< 5.3.2
▶Debiancz.nic/knot-resolver< 5.3.1-1+deb11u1+3

Patches

Patch: gitlab.nic.cz ↗Patch: gitlab.nic.cz ↗

🔴Vulnerability Details

3
GHSA
GHSA-wvjr-27w9-ff2r: Knot Resolver before 5↗2022-05-24
▶
OSV
CVE-2021-40083: Knot Resolver before 5↗2021-08-25
▶
CVEList
CVE-2021-40083: Knot Resolver before 5↗2021-08-25
▶

📋Vendor Advisories

1
Debian
CVE-2021-40083: knot-resolver - Knot Resolver before 5.3.2 is prone to an assertion failure, triggerable by a re...↗2021
▶
CVE-2021-40083 — Reachable Assertion in Knot Resolver | cvebase