Bug 1218297 (CVE-2023-7008)

Summary:	VUL-0: CVE-2023-7008: systemd-resolved: Unsigned name response in signed zone is not refused when DNSSEC=yes
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	fbui, gabriele.sonnu, gianluca.gabrielli
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/388806/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-7008:5.9:(AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2023-12-21 08:42:19 UTC

systemd-resolved accepts records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-7008

Comment 2 Gabriele Sonnu 2024-02-01 13:51:32 UTC

Upstream issue:

https://github.com/systemd/systemd/issues/25676

Upstream fix:

https://github.com/systemd/systemd/commit/3b4cc1437b51fcc0b08da8cc3f5d1175eed25eb1

Affected code found in:

- SUSE:ALP:Source:Standard:1.0/systemd
- SUSE:SLE-15-SP4:Update/systemd
- openSUSE:Factory/systemd

Comment 4 Franck Bui 2024-02-05 14:46:33 UTC

(In reply to Gabriele Sonnu from comment #2)
> Upstream fix:
> 
> https://github.com/systemd/systemd/commit/
> 3b4cc1437b51fcc0b08da8cc3f5d1175eed25eb1
> 

This fix has already been released for these code streams:

> Affected code found in:
> 
> - SUSE:ALP:Source:Standard:1.0/systemd
> - SUSE:SLE-15-SP4:Update/systemd
> - openSUSE:Factory/systemd

However the reference of this issue in the respective changelogs was missing. This has been addressed but I don't think it's worth submitting this single change alone.

Reassigning to the security team.

Comment 5 OBSbugzilla Bot 2024-02-07 15:35:03 UTC

This is an autogenerated message for OBS integration:
This bug (1218297) was mentioned in
https://build.opensuse.org/request/show/1144939 Factory / systemd

Comment 9 Andrea Mattiazzo 2024-07-19 13:04:46 UTC

All done, closing.