CVE Vulnerabilities

CVE-2018-17419

NULL Pointer Dereference

Published: Mar 07, 2019 | Modified: Oct 30, 2019
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
7.5 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM

An issue was discovered in setTA in scan_rr.go in the Miek Gieben DNS library before 1.0.10 for Go. A dns.ParseZone() parsing error causes a segmentation violation, leading to denial of service.

Weakness

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Affected Software

Name Vendor Start Version End Version
Dns_library Dns_library_project * 1.0.10 (excluding)
Red Hat OpenShift Container Platform 4.10 RedHat openshift4/ose-kube-proxy:v4.10.0-202305261541.p0.g15f00b7.assembly.stream *
Red Hat OpenShift Container Platform 4.11 RedHat openshift4/ose-kube-proxy:v4.11.0-202305240155.p0.g3018862.assembly.stream *
Red Hat OpenShift Container Platform 4.12 RedHat openshift4/ose-kube-proxy:v4.12.0-202305212342.p0.gd4b6594.assembly.stream *
Red Hat OpenShift Container Platform 4.13 RedHat openshift4/ose-kube-proxy:v4.13.0-202305180130.p0.gd56dc6a.assembly.stream *
Red Hat OpenShift Container Platform 4.14 RedHat openshift4/ose-sdn-rhel8:v4.14.0-202310201027.p0.g128c28c.assembly.stream *
Golang-github-miekg-dns Ubuntu bionic *
Golang-github-miekg-dns Ubuntu cosmic *
Golang-github-miekg-dns Ubuntu disco *
Golang-github-miekg-dns Ubuntu eoan *
Golang-github-miekg-dns Ubuntu groovy *
Golang-github-miekg-dns Ubuntu hirsute *
Golang-github-miekg-dns Ubuntu impish *
Golang-github-miekg-dns Ubuntu kinetic *
Golang-github-miekg-dns Ubuntu lunar *
Golang-github-miekg-dns Ubuntu mantic *

Potential Mitigations

References