high
7.5
CVE-2018-17419 json
miekg/dns parsing error leads to nil pointer dereference and DoS
published 2019-03-07 7 y ago modified 2026-06-17 4 mo ago also GHSA-9jcx-pr2f-qvq5 , GO-2020-0028 , EUVD-2021-1028
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.8%
- EPSS 1.8% chance of exploitation in 30 days, percentile 78%
- public exploits
- 0
- none known
Summary
An issue was discovered in setTA in scan_rr.go in the Miek Gieben DNS library before 1.0.10 for Go. A dns.ParseZone() parsing error causes a segmentation violation, leading to denial of service.
Patch / fix
- go github.com/miekg/dns 1.0.10
- dns_library_project dns_library 1.0.10
- github.com/miekg/dns#745 commit
- github.com/miekg/dns@501e858 commit
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2018-17419 updated cvss 7.5
dns: Denial of Service (DoS)
-
Red Hat OpenShift Container Platform 4.10 openshift4/ose-kube-proxy v4.10.0-202305261541.p0.g15f00b7.assembly.streamfixed: vendor fix RHSA-2023:3363
-
Red Hat OpenShift Container Platform 4.11 openshift4/ose-kube-proxy v4.11.0-202305240155.p0.g3018862.assembly.streamfixed: vendor fix RHSA-2023:3309
-
Red Hat OpenShift Container Platform 4.12 openshift4/ose-kube-proxy v4.12.0-202305212342.p0.gd4b6594.assembly.streamfixed: vendor fix RHSA-2023:3287
-
Red Hat OpenShift Container Platform 4.13 openshift4/ose-kube-proxy v4.13.0-202305180130.p0.gd56dc6a.assembly.streamfixed: vendor fix RHSA-2023:3304
-
Red Hat OpenShift Container Platform 4.14 openshift4/ose-sdn-rhel8 v4.14.0-202310201027.p0.g128c28c.assembly.streamfixed: vendor fix RHSA-2023:5006
-
Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-operator-rhel9, cert-manager/jetstack-cert-manager-rhel9 Red Hat Cost Management Metrics Operator costmanagement/costmanagement-metrics-rhel8-operator Red Hat Cryostat 2 cryostat-tech-preview/cryostat-rhel8-operator Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8-operator Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9, openshift-logging/opa-openshift-rhel8, openshift-logging/lokistack-gateway-rhel8, openshift-logging/elasticsearch-rhel8-operator, openshift-logging/cluster-logging-rhel8-operator Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-velero-rhel8, rhmtc/openshift-migration-velero-plugin-for-aws-rhel8, rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8, rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8not affected: vulnerable code not present
+29 more productsfewer
Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-controller-rhel9, migration-toolkit-virtualization/mtv-must-gather-api-rhel8 Red Hat mirror registry for Red Hat OpenShift mirror-registry-container Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel8-operator Red Hat OpenShift API for Data Protection oadp/oadp-velero-rhel8, oadp/oadp-rhel8-operator, oadp/oadp-velero-plugin-rhel8, oadp/oadp-velero-plugin-for-aws-rhel8, oadp/oadp-velero-plugin-for-csi-rhel8, oadp/oadp-velero-plugin-for-gcp-rhel9, +3 more Red Hat OpenShift Secondary Scheduler Operator openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8 Red Hat OpenShift Serverless openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/serving-queue-rhel8, openshift-serverless-1/eventing-mtping-rhel8, openshift-serverless-1/kourier-control-rhel8, openshift-serverless-1/ingress-rhel8-operator, openshift-serverless-1/net-istio-webhook-rhel8, +2 more Red Hat OpenShift Service Mesh 2 openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/prometheus-rhel8 Red Hat OpenShift Service Mesh 2.1 servicemesh, servicemesh-cni, servicemesh-prometheus, servicemesh-pilot-agent, servicemesh-pilot-discovery Red Hat 3scale API Management Platform 2 3scale-amp2/3scale-rhel7-operator Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/thanos-rhel7, rhacm2/volsync-rhel8, rhacm2/prometheus-rhel9, rhacm2/acm-grafana-rhel8, rhacm2/node-exporter-rhel8, rhacm2/observatorium-rhel8, +33 more Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-scanner-rhel8 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-scanner-rhel8 Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more Red Hat OpenShift Container Platform 4 microshift, microshift-olm, microshift-sriov, microshift-multus, microshift-selinux, openshift4/ose-pod, +184 more Red Hat OpenShift Container Platform 4.10 openshift4/ose-tests v4.10.0-202305241516.p0.gc24959f.assembly.stream, openshift4/ose-console v4.10.0-202305251818.p0.ga7884e0.assembly.stream, openshift4/ose-jenkins v4.10.0-202305251615.p0.gd2f7c5e.assembly.stream, openshift4/ose-sdn-rhel8 v4.10.0-202305261541.p0.g15f00b7.assembly.stream, openshift4/ose-tools-rhel8 v4.10.0-202305241516.p0.g3a7500d.assembly.stream, openshift4/ose-ironic-rhel8 v4.10.0-202305221128.p0.gcaf63f4.assembly.stream, +15 more Red Hat OpenShift Container Platform 4.11 openshift4/ose-tests v4.11.0-202305241516.p0.gd837641.assembly.stream, openshift4/ose-console v4.11.0-202305241516.p0.g680d42b.assembly.stream, openshift4/ose-sdn-rhel8 v4.11.0-202305240155.p0.g3018862.assembly.stream, openshift4/ose-tools-rhel8 v4.11.0-202305241516.p0.gdea6f47.assembly.stream, openshift4/ose-ironic-rhel8 v4.11.0-202305220715.p0.g3285ef2.assembly.stream, openshift4/ose-docker-builder v4.11.0-202305220715.p0.g5597323.assembly.stream, +10 more Red Hat OpenShift Container Platform 4.12 openshift4/ose-tests v4.12.0-202305232015.p0.g06127b0.assembly.stream, openshift4/ose-console v4.12.0-202305230354.p0.g359a706.assembly.stream, openshift4/ose-sdn-rhel8 v4.12.0-202305212342.p0.gd4b6594.assembly.stream, openshift4/ose-tools-rhel8 v4.12.0-202305220715.p0.g31aa3e8.assembly.stream, openshift4/ose-ironic-rhel9 v4.12.0-202305220715.p0.ga1c214f.assembly.stream, openshift4/ose-docker-builder v4.12.0-202305220715.p0.g0087881.assembly.stream, +16 more Red Hat OpenShift Container Platform 4.13 openshift4/ose-tests v4.13.0-202305220716.p0.g893ae57.assembly.stream, openshift4/ose-console v4.13.0-202305231941.p0.g6f58e08.assembly.stream, openshift4/ose-installer v4.13.0-202305202341.p0.g2f227cc.assembly.stream, openshift4/ose-sdn-rhel8 v4.13.0-202305180130.p0.gd56dc6a.assembly.stream, openshift4/ose-multus-cni v4.13.0-202305232329.p0.g5d283fa.assembly.stream, openshift4/ose-tools-rhel8 v4.13.0-202305220716.p0.g92b1a3d.assembly.stream, +46 more Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202310210434-0, openshift4/ose-cli v4.14.0-202310201027.p0.g0c63f9d.assembly.stream, openshift4/ose-pod v4.14.0-202310210404.p0.gf67aeb3.assembly.stream, openshift4/ose-tests v4.14.0-202310201027.p0.g948001a.assembly.stream, openshift4/ose-console v4.14.0-202310201027.p0.gc16ab01.assembly.stream, openshift4/ose-coredns v4.14.0-202310201027.p0.gfd70cf1.assembly.stream, +180 more Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8, rhai-tech-preview/assisted-installer-agent-rhel8 Red Hat Openshift Container Storage 4 ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, ocs4/ocs-rhel8-operator, ocs4/rook-ceph-rhel8-operator Red Hat Openshift Data Foundation 4 odf4/cephcsi-rhel9, odf4/odf-topolvm-rhel8, odf4/mcg-rhel9-operator, odf4/ocs-rhel9-operator, odf4/odf-rhel8-operator, odf4/odr-rhel9-operator, +5 more Red Hat OpenShift Data Science (RHODS) rhods/odh-mm-rest-proxy-rhel8, rhods/odh-operator-base-rhel8, rhods/odh-model-controller-rhel8, rhods/odh-ml-pipelines-cache-rhel8, rhods/odh-notebook-controller-rhel8, rhods/odh-modelmesh-serving-controller-rhel8 Red Hat OpenShift Dev Spaces devspaces/traefik-rhel8, devspaces/devspaces-rhel8-operator Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-rhel8-operator, rhosdt/opentelemetry-rhel8-operator, rhosdt/opentelemetry-collector-rhel8 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/gitops-rhel8, openshift-gitops-1/kam-delivery-rhel8, openshift-gitops-1/gitops-rhel8-operator Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator Red Hat OpenShift Virtualization 4 container-native-virtualization/hostpath-csi-driver-rhel8, container-native-virtualization/hostpath-csi-driver-rhel9
3 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
1.76% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/miekg/dns/issues/742 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/miekg/dns | <1.0.10 |
1.0.10 |
Classification
References
-
github.com
/miekg/dns/pull/745/commits/f71d7d9d77d439b30a5e50900df5b1f988a50e5e
web
-
github.com
/miekg/dns/commit/501e858f679edecd4a38a86317ce50271014a80d
web, patch
-
github.com
/miekg/dns/issues/742
web, exploit, third-party-advisory, report
-
nvd.nist.gov
/vuln/detail/CVE-2018-17419
advisory
-
github.com
/miekg/dns
package
-
pkg.go.dev
/vuln/GO-2020-0028
web
Sources
- CVE List CVE-2018-17419
- GitHub Advisory GHSA-9jcx-pr2f-qvq5
- NVD CVE-2018-17419
- OSV GO-2020-0028
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.