HIGH7.5

GHSA-9jcx-pr2f-qvq5

miekg/dns parsing error leads to nil pointer dereference and DoS

Quick fix

GHSA-9jcx-pr2f-qvq5 — github.com/miekg/dns: upgrade to the fixed version with the command below.

go get github.com/miekg/dns@v1.0.10

Details

An issue was discovered in `setTA` in `scan_rr.go` in the Miek Gieben DNS library before 1.0.10 for Go. A `dns.ParseZone()` parsing error causes a segmentation violation, leading to denial of service.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/miekg/dns

Introduced in: 0Fixed in: 1.0.10

Fixgo get github.com/miekg/dns@v1.0.10

References

https://nvd.nist.gov/vuln/detail/CVE-2018-17419[ADVISORY]
https://github.com/miekg/dns/issues/742[WEB]
https://github.com/miekg/dns/pull/745/commits/f71d7d9d77d439b30a5e50900df5b1f988a50e5e[WEB]
https://github.com/miekg/dns/commit/501e858f679edecd4a38a86317ce50271014a80d[WEB]
https://github.com/miekg/dns[PACKAGE]
https://pkg.go.dev/vuln/GO-2020-0028[WEB]