dnsjava DNS RR Relevance Check Bypass (Fixed in 3.6)
CVE-2024-25638 Published on July 22, 2024
DNSJava DNSSEC Bypass
dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.
Vulnerability Analysis
CVE-2024-25638 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and a small impact on availability.
Weakness Types
Insufficient Verification of Data Authenticity
The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Acceptance of Extraneous Untrusted Data With Trusted Data
The software, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
Products Associated with CVE-2024-25638
Want to know whenever a new CVE is published for Oracle? stack.watch will email you.
Affected Versions
dnsjava:- Version < 3.6.0 is affected.
- Before 3.6.0 is affected.
Vulnerable Packages
The following package name and versions may be associated with CVE-2024-25638
| Package Manager | Vulnerable Package | Versions | Fixed In |
|---|---|---|---|
| maven | dnsjava:dnsjava | < 3.6.0 | 3.6.0 |
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.