Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-25638

Good to know:

icon
icon

Date: July 22, 2024

dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.

Language: Java

Severity Score

Related Resources (6)

https://github.com/dnsjava/dnsjava/commit/bc51df1c455e6c9fb7cbd42fcb6d62d16047818d
https://nvd.nist.gov/vuln/detail/CVE-2024-25638
https://github.com/dnsjava/dnsjava/security/advisories/GHSA-cfxw-4h78-h7fw
https://github.com/dnsjava/dnsjava
https://github.com/dnsjava/dnsjava/commit/2073a0cdea2c560465f7ac0cc56f202e6fc39705
https://www.mend.io/vulnerability-database/CVE-2024-25638

Severity Score

Weakness Type (CWE)

Insufficient Verification of Data Authenticity

CWE-345

Acceptance of Extraneous Untrusted Data With Trusted Data

CWE-349

Top Fix

icon

Upgrade Version

Upgrade to version dnsjava:dnsjava:3.6.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): LOW

Do you need more information?

Contact Us