Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.
rust-hickory-resolver (the non-suffixed non-compat package) has been at version 0.26.3 for a while, and the only application that currently pulls in hickory-resolver (rust-siguldry-fedora-autopen) has been built with v0.26.3. Only the rust-hickory-resolver0.24 and rust-hickory-resolver0.25 package consumers are affected, and resolving this is not straightforward since it requires porting the applications / libraries to v0.26, which contains many breaking API changes.