Skip to main content

Insufficient Verification of Data Authenticity

CVE-2024-25638

High
8.9/10

Summary

The dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability affects the package dnsjava:dnsjava versions prior to 3.6.0.

  • HIGH
  • NETWORK
  • HIGH
  • CHANGED
  • NONE
  • NONE
  • HIGH
  • LOW

CWE-345 - Insufficient Verification of Data Authenticity

The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References

Advisory Timeline

  • Published