CVE-2020-19861

When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for the length value obtained from the zone file

published January 21, 2022

CVSS
—
EPSS
1%
Percentile
73.9
In the wild
Unconfirmed
What it is

When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for the length value obtained from the zone file. When the memcpy is copied, the 0xfe - ldns_rdf_size(salt_rdf) byte data can be copied, causing heap overflow information leakage.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01493 · 73.9th percentile
Published
2022-01-21T14:22Z
EPSS history
Timeline
  • 21 JAN 14:22Z
    When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for the length value obtained from the zone file
    cvelistv5