GHSA-6f2x-v7q7-m7m5: hickory-resolver follows irrelevant CNAME records
When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records that are not part of a CNAME chain starting from the original recursive query name, queries will be sent for those names. This increases query amplification beyond what is necessary to answer the recursive query.
References
- github.com/advisories/GHSA-6f2x-v7q7-m7m5
- github.com/hickory-dns/hickory-dns/commit/4689fc8d3ddd3e3f99ec1b7be4e2e9e78afd2e6b
- github.com/hickory-dns/hickory-dns/commit/ccd6952378f250c714fc2af0cb1053e1c179f832
- github.com/hickory-dns/hickory-dns/pull/3871
- github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2
- github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6f2x-v7q7-m7m5
Code Behaviors & Features
Detect and mitigate GHSA-6f2x-v7q7-m7m5 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →