See doc/triage.md for instructions on how to triage this report.
modules:
- module: TODO
versions:
- {}
packages:
- package: github.com/peterzen/goresolver
description: go-resolver's DNSSEC validation is not performed correctly. An attacker
can cause this package to report successful validation for invalid, attacker-controlled
records. The owner name of RRSIG RRs is not validated, permitting an attacker
to present the RRSIG for an attacker-controlled domain in a response for any other
domain.
cves:
- CVE-2022-3346
ghsas:
- GHSA-87mm-qxm5-cp3f
In GitHub Security Advisory GHSA-87mm-qxm5-cp3f, there is a vulnerability in the following Go packages or modules:
Cross references:
See doc/triage.md for instructions on how to triage this report.