CVE-2023-7008

一、漏洞信息
 漏洞编号：[CVE-2023-7008](https://nvd.nist.gov/vuln/detail/CVE-2023-7008)
 漏洞归属组件：[systemd](https://gitee.com/src-openeuler/systemd)
 漏洞归属的版本：243,246,248,249,253,255
 CVSS V3.0分值：
  BaseScore：5.9 Medium
  Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
 漏洞简述：
  A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.
 漏洞公开时间：2023-12-23 21:15:07
 漏洞创建时间：2023-12-22 23:03:32
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-7008
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| secalert.redhat.com | https://access.redhat.com/errata/RHSA-2024:2463 |  |
| secalert.redhat.com | https://access.redhat.com/errata/RHSA-2024:3203 |  |
| secalert.redhat.com | https://access.redhat.com/security/cve/CVE-2023-7008 |  |
| secalert.redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=2222261 |  |
| secalert.redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=2222672 |  |
| secalert.redhat.com | https://github.com/systemd/systemd/issues/25676 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-7008 | https://bugzilla.suse.com/show_bug.cgi?id=1218297 |
| redhat_bugzilla | https://github.com/systemd/systemd/issues/25676 | https://bugzilla.redhat.com/show_bug.cgi?id=2222672 |
| redhat_bugzilla | https://github.com/systemd/systemd/issues/25676 | https://bugzilla.redhat.com/show_bug.cgi?id=2222672 |
| redhat_bugzilla | https://github.com/systemd/systemd/issues/15158 | https://bugzilla.redhat.com/show_bug.cgi?id=2222672 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:2463 | https://bugzilla.redhat.com/show_bug.cgi?id=2222672 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:3203 | https://bugzilla.redhat.com/show_bug.cgi?id=2222672 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-7008 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2023-7008 |
| cve_search |  | https://access.redhat.com/security/cve/CVE-2023-7008 |
| cve_search |  | https://bugzilla.redhat.com/show_bug.cgi?id=2222261 |
| cve_search |  | https://bugzilla.redhat.com/show_bug.cgi?id=2222672 |
| cve_search |  | https://github.com/systemd/systemd/issues/25676 |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QHNBXGKJWISJETTTDTZKTBFIBJUOSLKL/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GMDEG5PKONWNHOEYSUDRT6JEOISRMN2/ |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2023-7008 | https://explore.alas.aws.amazon.com/CVE-2023-7008.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-7008 | https://explore.alas.aws.amazon.com/CVE-2023-7008.html |
| snyk | https://github.com/systemd/systemd-stable/commit/6da5ca9dd69c0e3340d4439413718ad4963252de | https://security.snyk.io/vuln/SNYK-UNMANAGED-SYSTEMDSYSTEMD-6139259 |
| snyk | https://github.com/systemd/systemd/issues/25676 | https://security.snyk.io/vuln/SNYK-UNMANAGED-SYSTEMDSYSTEMD-6139259 |
| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2222261 | https://security.snyk.io/vuln/SNYK-UNMANAGED-SYSTEMDSYSTEMD-6139259 |
| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2222672 | https://security.snyk.io/vuln/SNYK-UNMANAGED-SYSTEMDSYSTEMD-6139259 |
| snyk | https://access.redhat.com/security/cve/CVE-2023-7008 | https://security.snyk.io/vuln/SNYK-UNMANAGED-SYSTEMDSYSTEMD-6139259 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/systemd/systemd-stable/commit/6da5ca9dd69c0e3340d4439413718ad4963252de |  | snyk |
|  |  | https://access.redhat.com/security/cve/CVE-2023-7008 |  | nvd |
|  |  | https://bugzilla.redhat.com/show_bug.cgi?id=2222261 |  | nvd |
|  |  | https://bugzilla.redhat.com/show_bug.cgi?id=2222672 |  | nvd |
|  |  | https://github.com/systemd/systemd/issues/25676 |  | nvd |
|  |  | https://github.com/systemd/systemd/commit/3b4cc1437b51fcc0b08da8cc3f5d1175eed25eb1 |  | debian |
|  |  | https://github.com/systemd/systemd-stable/commit/6da5ca9dd69c0e3340d4439413718ad4963252de |  | debian |
|  |  | https://github.com/systemd/systemd-stable/commit/029272750fe451aeaac87a8c783cfb067f001e16 |  | debian |
|  |  | https://github.com/systemd/systemd-stable/commit/5c149c77cbf7b3743fa65ce7dc9d2b5a58351968 |  | debian |
|  |  | https://github.com/systemd/systemd-stable/commit/bb78da7f955c0102047319c55fff9d853ab7c87a |  | debian |
|  |  | https://github.com/systemd/systemd-stable/commit/f58fc88678b893162f2d6d4b2db094e7b1646386 |  | debian |
|  |  | https://github.com/systemd/systemd-stable/commit/4ada1290584745ab6643eece9e1756a8c0e079ca |  | debian |
|  |  | https://github.com/systemd/systemd-stable/commit/c8578cef7f0f1e8cb8193c29e5e77daf4e3a1c9f |  | debian |
|  |  | https://github.com/systemd/systemd-stable/commit/3a409b210396c6a0bef621349f4caa3a865940f2 |  | debian |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
      CVE-2023-7008，可通过MITM绕过systemd-resolved的DNSSEC验证，此问题会导致systemd解析接受DNSSEC签名域的记录，即使没有签名，也允许上游DNS解析程序操作记录。该CVE只有在systemd-resolved的DNSSEC=设置为“yes”的时候才会触发，但systemd中该选项默认设置为“no”，更改该值需要root权限，且openEuler默认不安装systemd-resolved，该CVE影响范围可控。  
 openEuler评分：
  5.9
 Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
 受影响版本排查(受影响/不受影响)：
  1.master(255):受影响
2.openEuler-20.03-LTS-SP1(243):受影响
3.openEuler-20.03-LTS-SP3(243):受影响
4.openEuler-20.03-LTS-SP4(243):受影响
5.openEuler-22.03-LTS(249):受影响
6.openEuler-22.03-LTS-Next(249):受影响
7.openEuler-22.03-LTS-SP1(249):受影响
8.openEuler-22.03-LTS-SP2(249):受影响
9.openEuler-22.03-LTS-SP3(249):受影响

修复是否涉及abi变化(是/否)：
  1.master(255):否
2.openEuler-20.03-LTS-SP1(243):否
3.openEuler-20.03-LTS-SP3(243):否
4.openEuler-20.03-LTS-SP4(243):否
5.openEuler-22.03-LTS(249):否
6.openEuler-22.03-LTS-Next(249):否
7.openEuler-22.03-LTS-SP1(249):否
8.openEuler-22.03-LTS-SP2(249):否
9.openEuler-22.03-LTS-SP3(249):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2262

src-openEuler/systemd
Closed

Content Risk Flag

Comments (20)

src-openEuler/systemdClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2023-7008

Comments (20)

Search

src-openEuler/systemd
Closed