Insufficient verification of data authenticity in dnsjava - CVE-2024-25638

Vulnerability identifier: #VU97732

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-25638

CWE-ID: CWE-345

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improper response validation when handling DNS queries. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. A remote attacker can bypass DNSSEC restrictions.

dnsjava
Netcool Operations Insight
IBM Watson Knowledge Catalog in Cloud Pak for Data
Oracle Communications Cloud Native Core Network Data Analytics Function
Oracle Communications Network Analytics Data Director
Oracle Communications Cloud Native Core Network Exposure Function
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
IBM Cloud Object Storage Systems
IBM Cloud Pak for Watson AIOps
IBM Application Suite - IBM Asset Data Dictionary Component
User Entity Behavior Analytics
Cognos Dashboards on Cloud Pak for Data
Oracle Communications Converged Application Server
IBM InfoSphere Information Server
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Security Edge Protection Proxy
openEuler
watsonx.data
dnsjava
dnsjava-javadoc

Install updates from vendor's website.

dnsjava - update to 3.6.0
Netcool Operations Insight - update to 1.6.15
IBM Cloud Pak for Watson AIOps - update to 4.10.0
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 3
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.15
watsonx.data - update to 2.0.3
dnsjava - update to 3.5.3-2
dnsjava-javadoc - update to 3.5.3-2
IBM Cloud Object Storage Systems - addressed in versions 3.18.0.84, 3.18.5.40
User Entity Behavior Analytics - update to 5.0.2
Cognos Dashboards on Cloud Pak for Data - update to 5.1

• https://github.com/dnsjava/dnsjava/security/advisories/GHSA-cfxw-4h78-h7fw
• https://github.com/dnsjava/dnsjava/commit/2073a0cdea2c560465f7ac0cc56f202e6fc39705

• DNSSEC bypass in dnsjava
• openEuler 24.03 LTS update for dnsjava
• IBM watsonx.data update for dnsjava
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Service Communication Proxy
• Insufficient verification of data authenticity in Oracle Communications Converged Application Server
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in IBM Cloud Object System
• Multiple vulnerabilities in IBM Asset Data Dictionary Component
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• Multiple vulnerabilities in Oracle Communications Network Analytics Data Director
• Multiple vulnerabilities in IBM Watson Knowledge Catalog
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Exposure Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Data Analytics Function
• Multiple vulnerabilities in IBM User Entity Behavior Analytics
• Multiple vulnerabilities in Netcool Operations Insight
• IBM InfoSphere Information Server update for dnsjava