CVE-2018-20994

Name of the Vulnerable Software and Affected Versions trust-dns-proto versions prior to 0.4.3 trust-dns-proto versions prior to 0.5.0

Description The issue arises from the mishandling of DNS message compression, leading to infinite recursion and a stack overflow when parsing a malicious DNS packet. This allows an attacker to craft a malicious packet that, when consumed by the affected software, could cause a crash. The parser can be tricked into an infinite loop when a compression offset points back to the same domain name to be parsed.

Recommendations For trust-dns-proto versions prior to 0.4.3, update to version 0.4.3 or later to resolve the issue. For trust-dns-proto versions prior to 0.5.0, update to version 0.5.0 or later once it is released. As a temporary workaround, consider restricting the use of the DNS message compression feature until a patch is available.