CVE-2023-7008
MediumCVSS 5.9Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.
Risk Assessment
An attacker may forge DNS responses, redirecting users to malicious resources. This undermines trust in DNSSEC and may lead to traffic interception.
Recommendation
Update systemd to a version containing the fix for systemd-resolved. Monitor your distribution's security bulletins for the appropriate update.
Other vulnerabilities in systemd-resolved
Original NVD description (English source)
A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS