DNS Response Validation Flaw in dnsjava Package
Summary
CVE-2024-25638: dnsjava is an implementation of DNS in Java. Affects dnsjava across 2 version ranges.
< 2073a0cdea2c560465f7ac0cc56f202e6fc39705
< bc51df1c455e6c9fb7cbd42fcb6d62d16047818d
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dnsjava is a Java-based implementation of the Domain Name System (DNS) protocol, designed to facilitate DNS queries and responses. It is widely used in various applications for DNS resolution. The package allows developers to interact with DNS servers, manage DNS records, and perform lookups efficiently. However, a critical vulnerability has been identified that compromises the integrity of DNS responses, potentially allowing attackers to exploit the system.
Vulnerability Detail
The vulnerability, identified as CVE-2024-25638, arises from the lack of validation for DNS reply records in relation to the original query. This oversight permits an attacker to respond with resource records (RRs) that belong to different DNS zones, leading to possible data leakage, unauthorized access, or redirection to malicious sites. The flaw exists in all versions prior to 3.6.0, making it crucial for users to upgrade to mitigate risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement additional validation checks in their application code to ensure that DNS responses are relevant to the original queries. This may involve filtering out any responses that do not match the expected domain or zone.
Conclusion
The CVE-2024-25638 vulnerability in the dnsjava package poses significant risks due to improper validation of DNS responses. Users are strongly advised to upgrade to version 3.6.0 or later to ensure their systems are secure. Implementing temporary workarounds can help mitigate risks until an upgrade is feasible.
See every vulnerability recorded for dnsjava →
FAQ
CVE-2024-25638 is a vulnerability in the dnsjava package that allows attackers to respond with DNS records from different zones, compromising the integrity of DNS queries.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The risks include data leakage, unauthorized access to sensitive information, and possible redirection to malicious websites, which can lead to further exploitation.
Yes, the vulnerability is fixed in version 3.6.0 of the dnsjava package. It is recommended to upgrade to this version or later.
If an immediate upgrade is not possible, implement additional validation checks in your application to filter out irrelevant DNS responses as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for dnsjava.
