CVE-2018-20994: Uncontrolled recursion in trust-dns-proto

August 25, 2021 (updated June 13, 2023)

There’s a stack overflow leading to a crash when Trust-DNS’s parses a malicious DNS packet. Affected versions of this crate did not properly handle parsing of DNS message compression (RFC1035 section 4.1.4). The parser could be tricked into infinite loop when a compression offset pointed back to the same domain name to be parsed. This allows an attacker to craft a malicious DNS packet which when consumed with Trust-DNS could cause stack overflow and crash the affected software.

References

github.com/advisories/GHSA-369h-pjr2-6wrh
github.com/bluejekyll/trust-dns
nvd.nist.gov/vuln/detail/CVE-2018-20994
rustsec.org/advisories/RUSTSEC-2018-0007.html

Code Behaviors & Features

Detect and mitigate CVE-2018-20994 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →