Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 23 Apr 2018 14:30:02 +0200
From: Petr Špaček <>
Subject: CVE-2018-1110: Knot Resolver <= 2.2.0 Improper Input Validation


Knot Resolver software version <= 2.2.0 suffers from Improper Input
Validation bugs which allow remote attacker to crash the resolver by
sending specially crafted packets.

Knot Resolver 2.3.0 fixes all known security bugs and is available from

To fix the bugs we had to do major changes to some data structures so
backport it most likely not feasible. We are discontinuing support for
*all* versions older than 2.3.0 and discourage attempts to backport
fixes because these will most likely introduce additional bugs.

CVE request data
Fixed version:
Knot Resolver 2.3.0

Vulnerability type:
CWE-20: Improper Input Validation

Affected component:

Impact of exploitation:
Program crashes.

Description of vulnerability:
Improper input validation bugs in DNS resolver component of Knot
Resolver (up to and including version 2.2.0) allow remote attacker who
can create malformed packets to cause denial of service.

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): None
Integrity (I): Low
Availability (A): High

Technical Details:

CZ.NIC would like to thank Toshifumi Sakaguchi and Vicky Shrestha for
their responsible reporting of security vulnerabilities.

Petr Špaček  @  CZ.NIC

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.