Skip to content
Fencer Intel
high 7.5

CVE-2018-17419 json

miekg/dns parsing error leads to nil pointer dereference and DoS

published 7y ago modified 4mo ago also GHSA-9jcx-pr2f-qvq5 , GO-2020-0028 , EUVD-2021-1028

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits
0
none known

Summary

An issue was discovered in setTA in scan_rr.go in the Miek Gieben DNS library before 1.0.10 for Go. A dns.ParseZone() parsing error causes a segmentation violation, leading to denial of service.

Patch / fix

  • go github.com/miekg/dns 1.0.10
  • dns_library_project dns_library 1.0.10

Is CVE-2018-17419 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-17419 updated cvss 7.5

dns: Denial of Service (DoS)

  • Red Hat OpenShift Container Platform 4.10 openshift4/ose-kube-proxy v4.10.0-202305261541.p0.g15f00b7.assembly.stream
    fixed: vendor fix RHSA-2023:3363
  • Red Hat OpenShift Container Platform 4.11 openshift4/ose-kube-proxy v4.11.0-202305240155.p0.g3018862.assembly.stream
    fixed: vendor fix RHSA-2023:3309
  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-kube-proxy v4.12.0-202305212342.p0.gd4b6594.assembly.stream
    fixed: vendor fix RHSA-2023:3287
  • Red Hat OpenShift Container Platform 4.13 openshift4/ose-kube-proxy v4.13.0-202305180130.p0.gd56dc6a.assembly.stream
    fixed: vendor fix RHSA-2023:3304
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-sdn-rhel8 v4.14.0-202310201027.p0.g128c28c.assembly.stream
    fixed: vendor fix RHSA-2023:5006
  • Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-operator-rhel9, cert-manager/jetstack-cert-manager-rhel9 Red Hat Cost Management Metrics Operator costmanagement/costmanagement-metrics-rhel8-operator Red Hat Cryostat 2 cryostat-tech-preview/cryostat-rhel8-operator Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8-operator Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9, openshift-logging/opa-openshift-rhel8, openshift-logging/lokistack-gateway-rhel8, openshift-logging/elasticsearch-rhel8-operator, openshift-logging/cluster-logging-rhel8-operator Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-velero-rhel8, rhmtc/openshift-migration-velero-plugin-for-aws-rhel8, rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8, rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8
    +29 more products
    Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-controller-rhel9, migration-toolkit-virtualization/mtv-must-gather-api-rhel8 Red Hat mirror registry for Red Hat OpenShift mirror-registry-container Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel8-operator Red Hat OpenShift API for Data Protection oadp/oadp-velero-rhel8, oadp/oadp-rhel8-operator, oadp/oadp-velero-plugin-rhel8, oadp/oadp-velero-plugin-for-aws-rhel8, oadp/oadp-velero-plugin-for-csi-rhel8, oadp/oadp-velero-plugin-for-gcp-rhel9, +3 more Red Hat OpenShift Secondary Scheduler Operator openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8 Red Hat OpenShift Serverless openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/serving-queue-rhel8, openshift-serverless-1/eventing-mtping-rhel8, openshift-serverless-1/kourier-control-rhel8, openshift-serverless-1/ingress-rhel8-operator, openshift-serverless-1/net-istio-webhook-rhel8, +2 more Red Hat OpenShift Service Mesh 2 openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/prometheus-rhel8 Red Hat OpenShift Service Mesh 2.1 servicemesh, servicemesh-cni, servicemesh-prometheus, servicemesh-pilot-agent, servicemesh-pilot-discovery Red Hat 3scale API Management Platform 2 3scale-amp2/3scale-rhel7-operator Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/thanos-rhel7, rhacm2/volsync-rhel8, rhacm2/prometheus-rhel9, rhacm2/acm-grafana-rhel8, rhacm2/node-exporter-rhel8, rhacm2/observatorium-rhel8, +33 more Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-scanner-rhel8 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-scanner-rhel8 Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more Red Hat OpenShift Container Platform 4 microshift, microshift-olm, microshift-sriov, microshift-multus, microshift-selinux, openshift4/ose-pod, +184 more Red Hat OpenShift Container Platform 4.10 openshift4/ose-tests v4.10.0-202305241516.p0.gc24959f.assembly.stream, openshift4/ose-console v4.10.0-202305251818.p0.ga7884e0.assembly.stream, openshift4/ose-jenkins v4.10.0-202305251615.p0.gd2f7c5e.assembly.stream, openshift4/ose-sdn-rhel8 v4.10.0-202305261541.p0.g15f00b7.assembly.stream, openshift4/ose-tools-rhel8 v4.10.0-202305241516.p0.g3a7500d.assembly.stream, openshift4/ose-ironic-rhel8 v4.10.0-202305221128.p0.gcaf63f4.assembly.stream, +15 more Red Hat OpenShift Container Platform 4.11 openshift4/ose-tests v4.11.0-202305241516.p0.gd837641.assembly.stream, openshift4/ose-console v4.11.0-202305241516.p0.g680d42b.assembly.stream, openshift4/ose-sdn-rhel8 v4.11.0-202305240155.p0.g3018862.assembly.stream, openshift4/ose-tools-rhel8 v4.11.0-202305241516.p0.gdea6f47.assembly.stream, openshift4/ose-ironic-rhel8 v4.11.0-202305220715.p0.g3285ef2.assembly.stream, openshift4/ose-docker-builder v4.11.0-202305220715.p0.g5597323.assembly.stream, +10 more Red Hat OpenShift Container Platform 4.12 openshift4/ose-tests v4.12.0-202305232015.p0.g06127b0.assembly.stream, openshift4/ose-console v4.12.0-202305230354.p0.g359a706.assembly.stream, openshift4/ose-sdn-rhel8 v4.12.0-202305212342.p0.gd4b6594.assembly.stream, openshift4/ose-tools-rhel8 v4.12.0-202305220715.p0.g31aa3e8.assembly.stream, openshift4/ose-ironic-rhel9 v4.12.0-202305220715.p0.ga1c214f.assembly.stream, openshift4/ose-docker-builder v4.12.0-202305220715.p0.g0087881.assembly.stream, +16 more Red Hat OpenShift Container Platform 4.13 openshift4/ose-tests v4.13.0-202305220716.p0.g893ae57.assembly.stream, openshift4/ose-console v4.13.0-202305231941.p0.g6f58e08.assembly.stream, openshift4/ose-installer v4.13.0-202305202341.p0.g2f227cc.assembly.stream, openshift4/ose-sdn-rhel8 v4.13.0-202305180130.p0.gd56dc6a.assembly.stream, openshift4/ose-multus-cni v4.13.0-202305232329.p0.g5d283fa.assembly.stream, openshift4/ose-tools-rhel8 v4.13.0-202305220716.p0.g92b1a3d.assembly.stream, +46 more Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202310210434-0, openshift4/ose-cli v4.14.0-202310201027.p0.g0c63f9d.assembly.stream, openshift4/ose-pod v4.14.0-202310210404.p0.gf67aeb3.assembly.stream, openshift4/ose-tests v4.14.0-202310201027.p0.g948001a.assembly.stream, openshift4/ose-console v4.14.0-202310201027.p0.gc16ab01.assembly.stream, openshift4/ose-coredns v4.14.0-202310201027.p0.gfd70cf1.assembly.stream, +180 more Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8, rhai-tech-preview/assisted-installer-agent-rhel8 Red Hat Openshift Container Storage 4 ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, ocs4/ocs-rhel8-operator, ocs4/rook-ceph-rhel8-operator Red Hat Openshift Data Foundation 4 odf4/cephcsi-rhel9, odf4/odf-topolvm-rhel8, odf4/mcg-rhel9-operator, odf4/ocs-rhel9-operator, odf4/odf-rhel8-operator, odf4/odr-rhel9-operator, +5 more Red Hat OpenShift Data Science (RHODS) rhods/odh-mm-rest-proxy-rhel8, rhods/odh-operator-base-rhel8, rhods/odh-model-controller-rhel8, rhods/odh-ml-pipelines-cache-rhel8, rhods/odh-notebook-controller-rhel8, rhods/odh-modelmesh-serving-controller-rhel8 Red Hat OpenShift Dev Spaces devspaces/traefik-rhel8, devspaces/devspaces-rhel8-operator Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-rhel8-operator, rhosdt/opentelemetry-rhel8-operator, rhosdt/opentelemetry-collector-rhel8 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/gitops-rhel8, openshift-gitops-1/kam-delivery-rhel8, openshift-gitops-1/gitops-rhel8-operator Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator Red Hat OpenShift Virtualization 4 container-native-virtualization/hostpath-csi-driver-rhel8, container-native-virtualization/hostpath-csi-driver-rhel9
    not affected: vulnerable code not present

3 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.76% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/miekg/dns/issues/742 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/miekg/dns
<1.0.10
1.0.10

Classification

Weakness
  • CWE-476 NULL Pointer Dereference
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.