Vulnerability Details CVE-2019-10190
A vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers to bypass DNSSEC validation for non-existence answer. NXDOMAIN answer would get passed through to the client even if its DNSSEC validation failed, instead of sending a SERVFAIL packet. Caching is not affected by this particular bug but see CVE-2019-10191.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.008
EPSS Ranking 72.9%
CVSS Severity
CVSS v3 Score 5.4
CVSS v2 Score 5.0
Products affected by CVE-2019-10190
-
cpe:2.3:a:nic:knot_resolver:-
-
cpe:2.3:a:nic:knot_resolver:1.0.0
-
cpe:2.3:a:nic:knot_resolver:1.1.0
-
cpe:2.3:a:nic:knot_resolver:1.1.1
-
cpe:2.3:a:nic:knot_resolver:1.2.0
-
cpe:2.3:a:nic:knot_resolver:1.2.1
-
cpe:2.3:a:nic:knot_resolver:1.2.2
-
cpe:2.3:a:nic:knot_resolver:1.2.3
-
cpe:2.3:a:nic:knot_resolver:1.2.4
-
cpe:2.3:a:nic:knot_resolver:1.2.5
-
cpe:2.3:a:nic:knot_resolver:1.2.6
-
cpe:2.3:a:nic:knot_resolver:1.3.0
-
cpe:2.3:a:nic:knot_resolver:1.3.1
-
cpe:2.3:a:nic:knot_resolver:1.3.2
-
cpe:2.3:a:nic:knot_resolver:1.3.3
-
cpe:2.3:a:nic:knot_resolver:1.4.0
-
cpe:2.3:a:nic:knot_resolver:1.5.0
-
cpe:2.3:a:nic:knot_resolver:1.5.1
-
cpe:2.3:a:nic:knot_resolver:1.5.2
-
cpe:2.3:a:nic:knot_resolver:1.5.3
-
cpe:2.3:a:nic:knot_resolver:1.99.1
-
cpe:2.3:a:nic:knot_resolver:2.0.0
-
cpe:2.3:a:nic:knot_resolver:2.1.0
-
cpe:2.3:a:nic:knot_resolver:2.1.1
-
cpe:2.3:a:nic:knot_resolver:2.2.0
-
cpe:2.3:a:nic:knot_resolver:2.3.0
-
cpe:2.3:a:nic:knot_resolver:2.4.0
-
cpe:2.3:a:nic:knot_resolver:2.4.1
-
cpe:2.3:a:nic:knot_resolver:3.0.0
-
cpe:2.3:a:nic:knot_resolver:3.1.0
-
cpe:2.3:a:nic:knot_resolver:3.2.0
-
cpe:2.3:a:nic:knot_resolver:4.0.0
-
cpe:2.3:o:fedoraproject:fedora:29
-
cpe:2.3:o:fedoraproject:fedora:30