Bug 2180266 (CVE-2022-30256)

Summary:	CVE-2022-30256 maradns: MaraDNS Deadwood that allows variant V1 of unintended domain name resolution
Product:	[Other] Security Response	Reporter:	Sandipan Roy <saroy>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-03-21 08:02:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2180267
Bug Blocks:

Description Sandipan Roy 2023-03-21 04:48:51 UTC

Source: maradns
X-Debbugs-CC: team.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for maradns.

CVE-2022-30256[0]:
| An issue was discovered in MaraDNS Deadwood through 3.5.0021 that
| allows variant V1 of unintended domain name resolution. A revoked
| domain name can still be resolvable for a long time, including expired
| domains and taken-down malicious domains. The effects of an exploit
| would be widespread and highly impactful, because the exploitation
| conforms to de facto DNS specifications and operational practices, and
| overcomes current mitigation patches for "Ghost" domain names.

https://maradns.samiam.org/security.html#CVE-2022-30256

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-30256
    https://www.cve.org/CVERecord?id=CVE-2022-30256

Please adjust the affected versions in the BTS as needed.

Comment 1 Sandipan Roy 2023-03-21 04:49:08 UTC

Created maradns tracking bugs for this issue:

Affects: fedora-all [bug 2180267]

Comment 2 Product Security DevOps Team 2023-03-21 08:02:00 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.