Description
Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set, because of an improper TSIG validity period check.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | knot | 2.5.3-1 | — |
| Debian 13 | knot | 2.5.3-1 | — |
| Debian 12 | knot | 2.5.3-1 | — |
| Debian 9 | knot | 2.4.0-3+deb9u1 | DSA-3910-1 |
| Debian 8 | knot | 1.6.0-1+deb8u1 | DSA-3910-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | knot | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP2 | knot | 1.6.8-bp152.4.3.1 | openSUSE-SU-2020:1232-1 |
| SUSE Package Hub 15 SP1 | knot | 1.6.8-bp151.4.3.1 | openSUSE-SU-2020:1112-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.2 | knot | 1.6.8-lp152.5.3.1 | openSUSE-SU-2020:1086-1 |
| openSUSE Leap 15.1 | knot | 1.6.8-lp151.4.3.1 | openSUSE-SU-2020:1085-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.6 | knot | 2.4.5-r0 | — |
Advisories 5
- DSA-3910-1 knot - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2020:1112-1 Security update for knot SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1086-1 Security update for knot SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1085-1 Security update for knot SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1232-1 Security update for knot SUSE / openSUSE Security Updates · Feb 4, 2026
References
- DSA-3910 vendor-advisory
- 99598 vdb-entry
- https://bugs.debian.org/865678
- http://www.synacktiv.ninja/ressources/Knot_DNS_TSIG_Signature_Forgery.pdf
- https://lists.nic.cz/pipermail/knot-dns-users/2017-June/001144.html
- openSUSE-SU-2020:1086 vendor-advisory
- openSUSE-SU-2020:1085 vendor-advisory
- openSUSE-SU-2020:1112 vendor-advisory
- openSUSE-SU-2020:1232 vendor-advisory