Vulnerability in Cz.nic Knot-Resolver
CVE-2019-19331
knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.022 (81.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 82nd percentile — 81.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.022 · newest: 0.022 · change: 0.000
Affected products
- Cz.nic Knot-Resolver — versions 4.3.0
- Nic Knot Resolver
- Debian Linux — versions 10.0
Weakness classification (CWE)
References
- bugzilla.redhat.com/show_bug.cgi (Exploit, Patch, Issue Tracking)
- www.knot-resolver.cz/2019-12-04-knot-resolver-4.3.0.html (Release Notes, Vendor Advisory)
- lists.debian.org/debian-lts-announce/2024/04/msg00017.html (mailing-list)
Frequently asked questions
- What is CVE-2019-19331?
- CVE-2019-19331 is a high-severity vulnerability in Cz.nic Knot-Resolver, classified under Inefficient Algorithmic Complexity. CVSS score: 7.5/10. Published 2019-12-16.
- How severe is CVE-2019-19331?
- High severity. CVSS v3 base score is 7.5 out of 10.