Go-Resolver Project: >> Go-Resolver Security Vulnerabilities
DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The owner name of RRSIG RRs is not validated, permitting an attacker to present the RRSIG for an attacker-controlled domain in a response for any other domain.
CVSS Score
6.5
EPSS Score
0.001
Published
2022-12-28
DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. Root DNSSEC public keys are not validated, permitting an attacker to present a self-signed root key and delegation chain.
CVSS Score
7.5
EPSS Score
0.001
Published
2022-12-28