{"id":"RUSTSEC-2020-0001","summary":"Stack overflow when resolving additional records from MX or SRV null targets","details":"There's a stack overflow leading to a crash and potential DOS when processing\nadditional records for return of MX or SRV record types from the server.\n\nThis is only possible when a zone is configured with a null target for MX or SRV records, i.e. '.'.\n\nExample effected zone record:\n```text\nno-service 86400 IN MX 0 .\n```\n\nPrior to 0.16.0 the additional record processing was not supported by trust-dns-server. There\nAre no known issues with upgrading from 0.16 or 0.17 to 0.18.1. The remidy should be to upgrade to\n0.18.1. If unable to do so, MX, SRV or other record types with a target to the null type, should be avoided.","aliases":["CVE-2020-35857","GHSA-4cww-f7w5-x525"],"modified":"2023-11-08T04:03:35.852947Z","published":"2020-01-06T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/trust-dns-server"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2020-0001.html"},{"type":"REPORT","url":"https://github.com/bluejekyll/trust-dns/issues/980"}],"affected":[{"package":{"name":"trust-dns-server","ecosystem":"crates.io","purl":"pkg:cargo/trust-dns-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.16.0"},{"fixed":"0.18.1"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["denial-of-service"],"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2020-0001.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}