GHSA-m6h2-634h-jcpj

Designate mDNS DoS through incorrect handling of large RecordSets

Source: GitHub Advisory Database (reviewed) High CVE-2015-5695

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	designate	2015.1.0b2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas when processing an internal zone file transfer, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted resource record set.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2015-5695 advisory
https://bugs.launchpad.net/designate/+bug/1471161 web
https://bugzilla.redhat.com/show_bug.cgi?id=1245241 web
https://github.com/ironsource-mobile/designate package
https://github.com/pypa/advisory-database/tree/main/vulns/designate/PYSEC-2017-114.yaml web
https://launchpadlibrarian.net/211525251/bug-1471161-quotas-master.patch web
https://www.openwall.com/lists/oss-security/2015/07/28/11 web
https://www.openwall.com/lists/oss-security/2015/07/29/6 web
http://lists.openstack.org/pipermail/openstack/2015-July/013548.html web