一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

漏洞公开时间：

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

漏洞公开时间：

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://fosstodon.org/@tychotithonus@infosec.exchange/111924626751024210 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://github.com/NLnetLabs/unbound/releases/tag/release-1.19.1 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://kb.isc.org/docs/cve-2023-50868 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| bind | | https://kb.isc.org/v1/docs/cve-2023-50868 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(9.16.37):

2.openEuler-20.03-LTS-SP1(9.11.21):

3.openEuler-20.03-LTS-SP4(9.11.21):

4.openEuler-22.03-LTS(9.16.23):

5.openEuler-22.03-LTS-Next(9.16.23):

6.openEuler-22.03-LTS-SP1(9.16.23):

7.openEuler-22.03-LTS-SP2(9.16.23):

8.openEuler-22.03-LTS-SP3(9.16.23):

修复是否涉及abi变化(是/否)：

1.master(9.16.37):

2.openEuler-20.03-LTS-SP1(9.11.21):

3.openEuler-20.03-LTS-SP4(9.11.21):

4.openEuler-22.03-LTS(9.16.23):

5.openEuler-22.03-LTS-Next(9.16.23):

6.openEuler-22.03-LTS-SP1(9.16.23):

7.openEuler-22.03-LTS-SP2(9.16.23):

8.openEuler-22.03-LTS-SP3(9.16.23):

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

漏洞公开时间：

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://fosstodon.org/@tychotithonus@infosec.exchange/111924626751024210 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://github.com/NLnetLabs/unbound/releases/tag/release-1.19.1 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://kb.isc.org/docs/cve-2023-50868 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| bind | | https://kb.isc.org/v1/docs/cve-2023-50868 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(9.16.37):

2.openEuler-20.03-LTS-SP1(9.11.21):

3.openEuler-20.03-LTS-SP4(9.11.21):

4.openEuler-22.03-LTS(9.16.23):

5.openEuler-22.03-LTS-Next(9.16.23):

6.openEuler-22.03-LTS-SP1(9.16.23):

7.openEuler-22.03-LTS-SP2(9.16.23):

8.openEuler-22.03-LTS-SP3(9.16.23):

修复是否涉及abi变化(是/否)：

1.master(9.16.37):

2.openEuler-20.03-LTS-SP1(9.11.21):

3.openEuler-20.03-LTS-SP4(9.11.21):

4.openEuler-22.03-LTS(9.16.23):

5.openEuler-22.03-LTS-Next(9.16.23):

6.openEuler-22.03-LTS-SP1(9.16.23):

7.openEuler-22.03-LTS-SP2(9.16.23):

8.openEuler-22.03-LTS-SP3(9.16.23):

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in bind9. By flooding a DNSSEC resolver with responses coming from a DNSEC-signed zone using NSEC3, an attacker can lead the targeted resolver to a CPU exhaustion, further leading to a Denial of Service on the targeted host.

漏洞公开时间：

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://fosstodon.org/@tychotithonus@infosec.exchange/111924626751024210 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://github.com/NLnetLabs/unbound/releases/tag/release-1.19.1 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://kb.isc.org/docs/cve-2023-50868 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| bind | | https://kb.isc.org/v1/docs/cve-2023-50868 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

漏洞公开时间：

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| cve.mitre.org | https://datatracker.ietf.org/doc/html/rfc5155 | |

| cve.mitre.org | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html | |

| cve.mitre.org | https://kb.isc.org/docs/cve-2023-50868 | |

| cve.mitre.org | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ | |

| cve.mitre.org | https://www.isc.org/blogs/2024-bind-security-release/ | |

| redhat_bugzilla | https://fosstodon.org/@tychotithonus@infosec.exchange/111924626751024210 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://github.com/NLnetLabs/unbound/releases/tag/release-1.19.1 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://kb.isc.org/docs/cve-2023-50868 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| bind | | https://kb.isc.org/v1/docs/cve-2023-50868 |

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

漏洞公开时间：2024-02-15 00:15:45

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

漏洞公开时间：2024-02-15 00:15:45

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| cve.mitre.org | https://access.redhat.com/security/cve/CVE-2023-50868 | |

| cve.mitre.org | https://bugzilla.suse.com/show_bug.cgi?id=1219826 | |

| cve.mitre.org | https://datatracker.ietf.org/doc/html/rfc5155 | |

| cve.mitre.org | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html | |

| cve.mitre.org | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 | |

| cve.mitre.org | https://kb.isc.org/docs/cve-2023-50868 | |

| cve.mitre.org | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | |

| cve.mitre.org | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ | |

| cve.mitre.org | https://www.isc.org/blogs/2024-bind-security-release/ | |

| redhat_bugzilla | https://fosstodon.org/@tychotithonus@infosec.exchange/111924626751024210 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://github.com/NLnetLabs/unbound/releases/tag/release-1.19.1 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://kb.isc.org/docs/cve-2023-50868 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| bind | | https://kb.isc.org/v1/docs/cve-2023-50868 |

| cve_search | | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ |

| cve_search | | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html |

| cve_search | | https://www.isc.org/blogs/2024-bind-security-release/ |

| cve_search | | https://datatracker.ietf.org/doc/html/rfc5155 |

| cve_search | | https://kb.isc.org/docs/cve-2023-50868 |

| cve_search | | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 |

| cve_search | | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html |

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

漏洞公开时间：2024-02-15 00:15:45

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

漏洞公开时间：2024-02-15 00:15:45

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/2 | |

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

漏洞公开时间：2024-02-15 00:15:45

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/2 | |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/3 | |

| cve.mitre.org | https://access.redhat.com/security/cve/CVE-2023-50868 | |

| cve.mitre.org | https://bugzilla.suse.com/show_bug.cgi?id=1219826 | |

| cve.mitre.org | https://datatracker.ietf.org/doc/html/rfc5155 | |

| cve.mitre.org | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html | |

| cve.mitre.org | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 | |

| cve.mitre.org | https://kb.isc.org/docs/cve-2023-50868 | |

| cve.mitre.org | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | |

| cve.mitre.org | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ | |

| cve.mitre.org | https://www.isc.org/blogs/2024-bind-security-release/ | |

| redhat_bugzilla | https://fosstodon.org/@tychotithonus@infosec.exchange/111924626751024210 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://github.com/NLnetLabs/unbound/releases/tag/release-1.19.1 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://kb.isc.org/docs/cve-2023-50868 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| bind | | https://kb.isc.org/v1/docs/cve-2023-50868 |

| cve_search | | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ |

| cve_search | | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html |

| cve_search | | https://www.isc.org/blogs/2024-bind-security-release/ |

| cve_search | | https://datatracker.ietf.org/doc/html/rfc5155 |

| cve_search | | https://kb.isc.org/docs/cve-2023-50868 |

| cve_search | | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 |

| cve_search | | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html |

| mageia | | http://advisories.mageia.org/MGASA-2024-0038.html |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2023-50868 | https://explore.alas.aws.amazon.com/CVE-2023-50868.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50868 | https://explore.alas.aws.amazon.com/CVE-2023-50868.html |

| snyk | https://kb.isc.org/docs/cve-2023-50868 | https://security.snyk.io/vuln/SNYK-UNMANAGED-BIND-6245755 |

| snyk | https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=3ae7f1ab0d847b17fdc95fd0e5b3120f66dc3af9 | https://security.snyk.io/vuln/SNYK-UNMANAGED-BIND-6245755 |

| snyk | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-BIND-6245755 |

| snyk | https://kb.isc.org/docs/cve-2023-50868 | https://security.snyk.io/vuln/SNYK-UNMANAGED-DNSMASQ-6245752 |

| snyk | https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=3ae7f1ab0d847b17fdc95fd0e5b3120f66dc3af9 | https://security.snyk.io/vuln/SNYK-UNMANAGED-DNSMASQ-6245752 |

| snyk | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-DNSMASQ-6245752 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=3ae7f1ab0d847b17fdc95fd0e5b3120f66dc3af9 | | snyk |

| | | https://www.nlnetlabs.nl/downloads/unbound/patch_CVE-2023-50387_CVE-2023-50868.diff | | unbound |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(9.16.37):

2.openEuler-20.03-LTS-SP1(9.11.21):

3.openEuler-20.03-LTS-SP4(9.11.21):

4.openEuler-22.03-LTS(9.16.23):

5.openEuler-22.03-LTS-Next(9.16.23):

6.openEuler-22.03-LTS-SP1(9.16.23):

7.openEuler-22.03-LTS-SP2(9.16.23):

8.openEuler-22.03-LTS-SP3(9.16.23):

修复是否涉及abi变化(是/否)：

1.master(9.16.37):

2.openEuler-20.03-LTS-SP1(9.11.21):

3.openEuler-20.03-LTS-SP4(9.11.21):

4.openEuler-22.03-LTS(9.16.23):

5.openEuler-22.03-LTS-Next(9.16.23):

6.openEuler-22.03-LTS-SP1(9.16.23):

7.openEuler-22.03-LTS-SP2(9.16.23):

8.openEuler-22.03-LTS-SP3(9.16.23):

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

漏洞公开时间：2024-02-15 00:15:45

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/2 | |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/3 | |

| cve.mitre.org | https://access.redhat.com/security/cve/CVE-2023-50868 | |

| cve.mitre.org | https://bugzilla.suse.com/show_bug.cgi?id=1219826 | |

| cve.mitre.org | https://datatracker.ietf.org/doc/html/rfc5155 | |

| cve.mitre.org | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html | |

| cve.mitre.org | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 | |

| cve.mitre.org | https://kb.isc.org/docs/cve-2023-50868 | |

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

漏洞公开时间：2024-02-15 00:15:45

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/2 | |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/3 | |

| cve.mitre.org | https://access.redhat.com/security/cve/CVE-2023-50868 | |

| cve.mitre.org | https://bugzilla.suse.com/show_bug.cgi?id=1219826 | |

| cve.mitre.org | https://datatracker.ietf.org/doc/html/rfc5155 | |

| cve.mitre.org | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html | |

| cve.mitre.org | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 | |

| cve.mitre.org | https://kb.isc.org/docs/cve-2023-50868 | |

| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/ | |

| cve.mitre.org | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | |

| cve.mitre.org | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ | |

| cve.mitre.org | https://www.isc.org/blogs/2024-bind-security-release/ | |

| redhat_bugzilla | https://fosstodon.org/@tychotithonus@infosec.exchange/111924626751024210 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://github.com/NLnetLabs/unbound/releases/tag/release-1.19.1 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://kb.isc.org/docs/cve-2023-50868 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| bind | | https://kb.isc.org/v1/docs/cve-2023-50868 |

| cve_search | | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ |

| cve_search | | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html |

| cve_search | | https://www.isc.org/blogs/2024-bind-security-release/ |

| cve_search | | https://datatracker.ietf.org/doc/html/rfc5155 |

| cve_search | | https://kb.isc.org/docs/cve-2023-50868 |

| cve_search | | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 |

| cve_search | | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html |

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

漏洞公开时间：2024-02-15 00:15:45

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/2 | |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/3 | |

| cve.mitre.org | https://access.redhat.com/security/cve/CVE-2023-50868 | |

| cve.mitre.org | https://bugzilla.suse.com/show_bug.cgi?id=1219826 | |

| cve.mitre.org | https://datatracker.ietf.org/doc/html/rfc5155 | |

| cve.mitre.org | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html | |

| cve.mitre.org | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 | |

| cve.mitre.org | https://kb.isc.org/docs/cve-2023-50868 | |

| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/ | |

| cve.mitre.org | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | |

| cve.mitre.org | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ | |

| cve.mitre.org | https://www.isc.org/blogs/2024-bind-security-release/ | |

| redhat_bugzilla | https://fosstodon.org/@tychotithonus@infosec.exchange/111924626751024210 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://github.com/NLnetLabs/unbound/releases/tag/release-1.19.1 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://kb.isc.org/docs/cve-2023-50868 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| bind | | https://kb.isc.org/v1/docs/cve-2023-50868 |

| cve_search | | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ |

| cve_search | | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html |

| cve_search | | https://www.isc.org/blogs/2024-bind-security-release/ |

| cve_search | | https://datatracker.ietf.org/doc/html/rfc5155 |

| cve_search | | https://kb.isc.org/docs/cve-2023-50868 |

| cve_search | | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 |

| cve_search | | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html |

| cve_search | | https://access.redhat.com/security/cve/CVE-2023-50868 |

| cve_search | | https://bugzilla.suse.com/show_bug.cgi?id=1219826 |

| cve_search | | http://www.openwall.com/lists/oss-security/2024/02/16/2 |

| cve_search | | http://www.openwall.com/lists/oss-security/2024/02/16/3 |

| cve_search | | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/ |

| mageia | | http://advisories.mageia.org/MGASA-2024-0038.html |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2023-50868 | https://explore.alas.aws.amazon.com/CVE-2023-50868.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50868 | https://explore.alas.aws.amazon.com/CVE-2023-50868.html |

| snyk | https://kb.isc.org/docs/cve-2023-50868 | https://security.snyk.io/vuln/SNYK-UNMANAGED-BIND-6245755 |

| snyk | https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=3ae7f1ab0d847b17fdc95fd0e5b3120f66dc3af9 | https://security.snyk.io/vuln/SNYK-UNMANAGED-BIND-6245755 |

| snyk | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-BIND-6245755 |

| snyk | https://kb.isc.org/docs/cve-2023-50868 | https://security.snyk.io/vuln/SNYK-UNMANAGED-DNSMASQ-6245752 |

| snyk | https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=3ae7f1ab0d847b17fdc95fd0e5b3120f66dc3af9 | https://security.snyk.io/vuln/SNYK-UNMANAGED-DNSMASQ-6245752 |

| snyk | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-DNSMASQ-6245752 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=3ae7f1ab0d847b17fdc95fd0e5b3120f66dc3af9 | | snyk |

| | | https://www.nlnetlabs.nl/downloads/unbound/patch_CVE-2023-50387_CVE-2023-50868.diff | | unbound |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

漏洞公开时间：2024-02-15 00:15:45

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/2 | |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/3 | |

| cve.mitre.org | https://access.redhat.com/security/cve/CVE-2023-50868 | |

| cve.mitre.org | https://bugzilla.suse.com/show_bug.cgi?id=1219826 | |

| cve.mitre.org | https://datatracker.ietf.org/doc/html/rfc5155 | |

| cve.mitre.org | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html | |

| cve.mitre.org | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 | |

| cve.mitre.org | https://kb.isc.org/docs/cve-2023-50868 | |

| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/ | |

| cve.mitre.org | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | |

| cve.mitre.org | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ | |

| cve.mitre.org | https://www.isc.org/blogs/2024-bind-security-release/ | |

| redhat_bugzilla | https://fosstodon.org/@tychotithonus@infosec.exchange/111924626751024210 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://github.com/NLnetLabs/unbound/releases/tag/release-1.19.1 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://kb.isc.org/docs/cve-2023-50868 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| bind | | https://kb.isc.org/v1/docs/cve-2023-50868 |

| cve_search | | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ |

| cve_search | | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html |

| cve_search | | https://www.isc.org/blogs/2024-bind-security-release/ |

| cve_search | | https://datatracker.ietf.org/doc/html/rfc5155 |

| cve_search | | https://kb.isc.org/docs/cve-2023-50868 |

| cve_search | | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 |

| cve_search | | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html |

| cve_search | | https://access.redhat.com/security/cve/CVE-2023-50868 |

| cve_search | | https://bugzilla.suse.com/show_bug.cgi?id=1219826 |

| cve_search | | http://www.openwall.com/lists/oss-security/2024/02/16/2 |

| cve_search | | http://www.openwall.com/lists/oss-security/2024/02/16/3 |

| cve_search | | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/ |

| mageia | | http://advisories.mageia.org/MGASA-2024-0038.html |

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

漏洞公开时间：2024-02-15 00:15:45

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/2 | |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/3 | |

| cve.mitre.org | https://access.redhat.com/security/cve/CVE-2023-50868 | |

| cve.mitre.org | https://bugzilla.suse.com/show_bug.cgi?id=1219826 | |

| cve.mitre.org | https://datatracker.ietf.org/doc/html/rfc5155 | |

| cve.mitre.org | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html | |

| cve.mitre.org | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 | |

| cve.mitre.org | https://kb.isc.org/docs/cve-2023-50868 | |

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

漏洞公开时间：2024-02-15 00:15:45

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/2 | |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/3 | |

| cve.mitre.org | https://access.redhat.com/security/cve/CVE-2023-50868 | |

| cve.mitre.org | https://bugzilla.suse.com/show_bug.cgi?id=1219826 | |

| cve.mitre.org | https://datatracker.ietf.org/doc/html/rfc5155 | |

| cve.mitre.org | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html | |

| cve.mitre.org | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 | |

| cve.mitre.org | https://kb.isc.org/docs/cve-2023-50868 | |

| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/ | |

| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/ | |

| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/ | |

| cve.mitre.org | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | |

| cve.mitre.org | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ | |

| cve.mitre.org | https://www.isc.org/blogs/2024-bind-security-release/ | |

| redhat_bugzilla | https://fosstodon.org/@tychotithonus@infosec.exchange/111924626751024210 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://github.com/NLnetLabs/unbound/releases/tag/release-1.19.1 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://kb.isc.org/docs/cve-2023-50868 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| bind | | https://kb.isc.org/v1/docs/cve-2023-50868 |

| cve_search | | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ |

| cve_search | | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html |

| cve_search | | https://www.isc.org/blogs/2024-bind-security-release/ |

| cve_search | | https://datatracker.ietf.org/doc/html/rfc5155 |

| cve_search | | https://kb.isc.org/docs/cve-2023-50868 |

| cve_search | | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 |

| cve_search | | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html |

| cve_search | | https://access.redhat.com/security/cve/CVE-2023-50868 |

| cve_search | | https://bugzilla.suse.com/show_bug.cgi?id=1219826 |

| cve_search | | http://www.openwall.com/lists/oss-security/2024/02/16/2 |

| cve_search | | http://www.openwall.com/lists/oss-security/2024/02/16/3 |

| cve_search | | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/ |

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

漏洞公开时间：2024-02-15 00:15:45

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/2 | |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/3 | |

| cve.mitre.org | https://access.redhat.com/security/cve/CVE-2023-50868 | |

| cve.mitre.org | https://bugzilla.suse.com/show_bug.cgi?id=1219826 | |

| cve.mitre.org | https://datatracker.ietf.org/doc/html/rfc5155 | |

| cve.mitre.org | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html | |

| cve.mitre.org | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 | |

| cve.mitre.org | https://kb.isc.org/docs/cve-2023-50868 | |

| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/ | |

| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/ | |

| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/ | |

| cve.mitre.org | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | |

| cve.mitre.org | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ | |

| cve.mitre.org | https://www.isc.org/blogs/2024-bind-security-release/ | |

| redhat_bugzilla | https://fosstodon.org/@tychotithonus@infosec.exchange/111924626751024210 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://github.com/NLnetLabs/unbound/releases/tag/release-1.19.1 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://kb.isc.org/docs/cve-2023-50868 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| bind | | https://kb.isc.org/v1/docs/cve-2023-50868 |

| cve_search | | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ |

| cve_search | | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html |

| cve_search | | https://www.isc.org/blogs/2024-bind-security-release/ |

| cve_search | | https://datatracker.ietf.org/doc/html/rfc5155 |

| cve_search | | https://kb.isc.org/docs/cve-2023-50868 |

| cve_search | | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 |

| cve_search | | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html |

| cve_search | | https://access.redhat.com/security/cve/CVE-2023-50868 |

| cve_search | | https://bugzilla.suse.com/show_bug.cgi?id=1219826 |

| cve_search | | http://www.openwall.com/lists/oss-security/2024/02/16/2 |

| cve_search | | http://www.openwall.com/lists/oss-security/2024/02/16/3 |

| cve_search | | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/ |

| cve_search | | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/ |

| cve_search | | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/ |

| mageia | | http://advisories.mageia.org/MGASA-2024-0038.html |

| osv | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | https://www.isc.org/blogs/2024-bind-security-release/ | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | https://bugzilla.suse.com/show_bug.cgi?id=1219826 | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | http://www.openwall.com/lists/oss-security/2024/02/16/2 | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | http://www.openwall.com/lists/oss-security/2024/02/16/3 | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | https://access.redhat.com/security/cve/CVE-2023-50868 | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | https://datatracker.ietf.org/doc/html/rfc5155 | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | https://kb.isc.org/docs/cve-2023-50868 | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/ | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ | https://osv.dev/vulnerability/CVE-2023-50868 |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2023-50868 | https://explore.alas.aws.amazon.com/CVE-2023-50868.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50868 | https://explore.alas.aws.amazon.com/CVE-2023-50868.html |

| snyk | https://kb.isc.org/docs/cve-2023-50868 | https://security.snyk.io/vuln/SNYK-UNMANAGED-BIND-6245755 |

| snyk | https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=3ae7f1ab0d847b17fdc95fd0e5b3120f66dc3af9 | https://security.snyk.io/vuln/SNYK-UNMANAGED-BIND-6245755 |

| snyk | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-BIND-6245755 |

| snyk | https://kb.isc.org/docs/cve-2023-50868 | https://security.snyk.io/vuln/SNYK-UNMANAGED-DNSMASQ-6245752 |

| snyk | https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=3ae7f1ab0d847b17fdc95fd0e5b3120f66dc3af9 | https://security.snyk.io/vuln/SNYK-UNMANAGED-DNSMASQ-6245752 |

| snyk | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-DNSMASQ-6245752 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=3ae7f1ab0d847b17fdc95fd0e5b3120f66dc3af9 | | snyk |

| | | https://www.nlnetlabs.nl/downloads/unbound/patch_CVE-2023-50387_CVE-2023-50868.diff | | unbound |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

9276.0

Vector：CVSS：2.0/

受影响版本排查(受影响/不受影响)：

1.master(9.16.37):受影响

2.openEuler-20.03-LTS-SP1(9.11.21):受影响

3.openEuler-20.03-LTS-SP4(9.11.21):受影响

4.openEuler-22.03-LTS(9.16.23):受影响

5.openEuler-22.03-LTS-Next(9.16.23):受影响

6.openEuler-22.03-LTS-SP1(9.16.23):受影响

7.openEuler-22.03-LTS-SP2(9.16.23):受影响

8.openEuler-22.03-LTS-SP3(9.16.23):受影响

修复是否涉及abi变化(是/否)：

1.master(9.16.37):否

2.openEuler-20.03-LTS-SP1(9.11.21):否

3.openEuler-20.03-LTS-SP4(9.11.21):否

4.openEuler-22.03-LTS(9.16.23):否

5.openEuler-22.03-LTS-Next(9.16.23):否

6.openEuler-22.03-LTS-SP1(9.16.23):否

7.openEuler-22.03-LTS-SP2(9.16.23):否

8.openEuler-22.03-LTS-SP3(9.16.23):否

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

漏洞公开时间：2024-02-15 00:15:45

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/2 | |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/3 | |

| cve.mitre.org | https://access.redhat.com/security/cve/CVE-2023-50868 | |

| cve.mitre.org | https://bugzilla.suse.com/show_bug.cgi?id=1219826 | |

| cve.mitre.org | https://datatracker.ietf.org/doc/html/rfc5155 | |

| cve.mitre.org | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html | |

| cve.mitre.org | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 | |

| cve.mitre.org | https://kb.isc.org/docs/cve-2023-50868 | |

| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/ | |

| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/ | |

| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/ | |

| cve.mitre.org | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | |

| cve.mitre.org | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ | |

| cve.mitre.org | https://www.isc.org/blogs/2024-bind-security-release/ | |

| redhat_bugzilla | https://fosstodon.org/@tychotithonus@infosec.exchange/111924626751024210 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://github.com/NLnetLabs/unbound/releases/tag/release-1.19.1 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://kb.isc.org/docs/cve-2023-50868 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| bind | | https://kb.isc.org/v1/docs/cve-2023-50868 |

| cve_search | | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ |

| cve_search | | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html |

| cve_search | | https://www.isc.org/blogs/2024-bind-security-release/ |

| cve_search | | https://datatracker.ietf.org/doc/html/rfc5155 |

| cve_search | | https://kb.isc.org/docs/cve-2023-50868 |

| cve_search | | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 |

| cve_search | | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html |

| cve_search | | https://access.redhat.com/security/cve/CVE-2023-50868 |

| cve_search | | https://bugzilla.suse.com/show_bug.cgi?id=1219826 |

| cve_search | | http://www.openwall.com/lists/oss-security/2024/02/16/2 |

| cve_search | | http://www.openwall.com/lists/oss-security/2024/02/16/3 |

| cve_search | | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/ |

| cve_search | | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/ |

| cve_search | | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/ |

| mageia | | http://advisories.mageia.org/MGASA-2024-0038.html |

| osv | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | https://www.isc.org/blogs/2024-bind-security-release/ | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | https://bugzilla.suse.com/show_bug.cgi?id=1219826 | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | http://www.openwall.com/lists/oss-security/2024/02/16/2 | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | http://www.openwall.com/lists/oss-security/2024/02/16/3 | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | https://access.redhat.com/security/cve/CVE-2023-50868 | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | https://datatracker.ietf.org/doc/html/rfc5155 | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | https://kb.isc.org/docs/cve-2023-50868 | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/ | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://osv.dev/vulnerability/CVE-2023-50868 |

| osv | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ | https://osv.dev/vulnerability/CVE-2023-50868 |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2023-50868 | https://explore.alas.aws.amazon.com/CVE-2023-50868.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50868 | https://explore.alas.aws.amazon.com/CVE-2023-50868.html |

| snyk | https://kb.isc.org/docs/cve-2023-50868 | https://security.snyk.io/vuln/SNYK-UNMANAGED-BIND-6245755 |

| snyk | https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=3ae7f1ab0d847b17fdc95fd0e5b3120f66dc3af9 | https://security.snyk.io/vuln/SNYK-UNMANAGED-BIND-6245755 |

| snyk | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-BIND-6245755 |

| snyk | https://kb.isc.org/docs/cve-2023-50868 | https://security.snyk.io/vuln/SNYK-UNMANAGED-DNSMASQ-6245752 |

| snyk | https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=3ae7f1ab0d847b17fdc95fd0e5b3120f66dc3af9 | https://security.snyk.io/vuln/SNYK-UNMANAGED-DNSMASQ-6245752 |

| snyk | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-DNSMASQ-6245752 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=3ae7f1ab0d847b17fdc95fd0e5b3120f66dc3af9 | | snyk |

| | | https://www.nlnetlabs.nl/downloads/unbound/patch_CVE-2023-50387_CVE-2023-50868.diff | | unbound |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

9276.0

Vector：CVSS：2.0/

受影响版本排查(受影响/不受影响)：

1.master(9.16.37):受影响

2.openEuler-20.03-LTS-SP1(9.11.21):受影响

3.openEuler-20.03-LTS-SP4(9.11.21):受影响

4.openEuler-22.03-LTS(9.16.23):受影响

5.openEuler-22.03-LTS-Next(9.16.23):受影响

6.openEuler-22.03-LTS-SP1(9.16.23):受影响

7.openEuler-22.03-LTS-SP2(9.16.23):受影响

8.openEuler-22.03-LTS-SP3(9.16.23):受影响

修复是否涉及abi变化(是/否)：

1.master(9.16.37):否

2.openEuler-20.03-LTS-SP1(9.11.21):否

3.openEuler-20.03-LTS-SP4(9.11.21):否

4.openEuler-22.03-LTS(9.16.23):否

5.openEuler-22.03-LTS-Next(9.16.23):否

6.openEuler-22.03-LTS-SP1(9.16.23):否

7.openEuler-22.03-LTS-SP2(9.16.23):否

8.openEuler-22.03-LTS-SP3(9.16.23):否

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

漏洞公开时间：2024-02-15 00:15:45

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/2 | |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/3 | |

| cve.mitre.org | https://access.redhat.com/security/cve/CVE-2023-50868 | |

| cve.mitre.org | https://bugzilla.suse.com/show_bug.cgi?id=1219826 | |

| cve.mitre.org | https://datatracker.ietf.org/doc/html/rfc5155 | |

| cve.mitre.org | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html | |

| cve.mitre.org | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 | |

| cve.mitre.org | https://kb.isc.org/docs/cve-2023-50868 | |

一、漏洞信息

漏洞编号：[CVE-2023-50868](https://nvd.nist.gov/vuln/detail/CVE-2023-50868)

漏洞归属组件：[bind](https://gitee.com/src-openeuler/bind)

漏洞归属的版本：9.11.21,9.11.4,9.16.23,9.16.37

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

漏洞公开时间：2024-02-15 00:15:45

漏洞创建时间：2024-02-14 00:32:33

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2023-50868

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/2 | |

| cve.mitre.org | http://www.openwall.com/lists/oss-security/2024/02/16/3 | |

| cve.mitre.org | https://access.redhat.com/security/cve/CVE-2023-50868 | |

| cve.mitre.org | https://bugzilla.suse.com/show_bug.cgi?id=1219826 | |

| cve.mitre.org | https://datatracker.ietf.org/doc/html/rfc5155 | |

| cve.mitre.org | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html | |

| cve.mitre.org | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 | |

| cve.mitre.org | https://kb.isc.org/docs/cve-2023-50868 | |

| cve.mitre.org | https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html | |

| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/ | |

| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/ | |

| cve.mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/ | |

| cve.mitre.org | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | |

| cve.mitre.org | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ | |

| cve.mitre.org | https://www.isc.org/blogs/2024-bind-security-release/ | |

| redhat_bugzilla | https://fosstodon.org/@tychotithonus@infosec.exchange/111924626751024210 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://github.com/NLnetLabs/unbound/releases/tag/release-1.19.1 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| redhat_bugzilla | https://kb.isc.org/docs/cve-2023-50868 | https://bugzilla.redhat.com/show_bug.cgi?id=2263917 |

| bind | | https://kb.isc.org/v1/docs/cve-2023-50868 |

| cve_search | | https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ |

| cve_search | | https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html |

| cve_search | | https://www.isc.org/blogs/2024-bind-security-release/ |

| cve_search | | https://datatracker.ietf.org/doc/html/rfc5155 |

| cve_search | | https://kb.isc.org/docs/cve-2023-50868 |

| cve_search | | https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 |

| cve_search | | https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html |

| cve_search | | https://access.redhat.com/security/cve/CVE-2023-50868 |

| cve_search | | https://bugzilla.suse.com/show_bug.cgi?id=1219826 |

| cve_search | | http://www.openwall.com/lists/oss-security/2024/02/16/2 |

| cve_search | | http://www.openwall.com/lists/oss-security/2024/02/16/3 |

| cve_search | | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/ |

| cve_search | | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/ |

| cve_search | | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/ |