Bug 1218297 (CVE-2023-7008) - VUL-0: CVE-2023-7008: systemd-resolved: Unsigned name response in signed zone is not refused when DNSSEC=yes
Summary: VUL-0: CVE-2023-7008: systemd-resolved: Unsigned name response in signed zone...
Status: RESOLVED FIXED
Alias: CVE-2023-7008
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/388806/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-7008:5.9:(AV:N...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-12-21 08:42 UTC by SMASH SMASH
Modified: 2024-07-19 13:04 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2023-12-21 08:42:19 UTC 
systemd-resolved accepts records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-7008
Comment 2 Gabriele Sonnu 2024-02-01 13:51:32 UTC 
Upstream issue:

https://github.com/systemd/systemd/issues/25676

Upstream fix:

https://github.com/systemd/systemd/commit/3b4cc1437b51fcc0b08da8cc3f5d1175eed25eb1

Affected code found in:

- SUSE:ALP:Source:Standard:1.0/systemd
- SUSE:SLE-15-SP4:Update/systemd
- openSUSE:Factory/systemd
Comment 4 Franck Bui 2024-02-05 14:46:33 UTC 
(In reply to Gabriele Sonnu from comment #2)
> Upstream fix:
> 
> https://github.com/systemd/systemd/commit/
> 3b4cc1437b51fcc0b08da8cc3f5d1175eed25eb1
> 

This fix has already been released for these code streams:

> Affected code found in:
> 
> - SUSE:ALP:Source:Standard:1.0/systemd
> - SUSE:SLE-15-SP4:Update/systemd
> - openSUSE:Factory/systemd

However the reference of this issue in the respective changelogs was missing. This has been addressed but I don't think it's worth submitting this single change alone.

Reassigning to the security team.
Comment 5 OBSbugzilla Bot 2024-02-07 15:35:03 UTC 
This is an autogenerated message for OBS integration:
This bug (1218297) was mentioned in
https://build.opensuse.org/request/show/1144939 Factory / systemd
Comment 9 Andrea Mattiazzo 2024-07-19 13:04:46 UTC 
All done, closing.