Every CVE Search/ Get API key

CVE-2019-10191

A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows...

6.3 MediumFix available

A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secure domains to DNSSEC-insecure state, opening possibility of domain hijack using attacks against insecure DNS protocol.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

1.93%Up 0.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 6.3

A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secure domains to DNSSEC-insecure state, opening possibility of domain hijack using attacks against insecure DNS protocol.

Record
CVE-2019-10191
CVSS 3.0
6.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2019-2214 6.3

A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secure domains to DNSSEC-insecure state, opening possibility of domain hijack using attacks against insecure DNS protocol.

Record
EUVD-2019-2214
CVSS 3.0
6.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-5w8c-g2pj-65rx 7.5

A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows...

A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secure domains to DNSSEC-insecure state, opening possibility of domain hijack using attacks against insecure DNS protocol.

Record
GHSA-5w8c-g2pj-65rx
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-20
Updated
2026-11-02
NVD 7.5

A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secure domains to DNSSEC-insecure state, opening possibility of domain hijack using attacks against insecure DNS protocol.

Record
CVE-2019-10191
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.0
6.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-20
Updated
2026-11-02
OSVALPINE-CVE-2019-10191 7.5

A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secure domains to DNSSEC-insecure state, opening possibility of domain hijack using attacks against insecure DNS protocol.

Record
ALPINE-CVE-2019-10191
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
OSV 7.5

A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secure domains to DNSSEC-insecure state, opening possibility of domain hijack using attacks against insecure DNS protocol.

Record
CVE-2019-10191
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2019-10191 7.5

A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secure domains to DNSSEC-insecure state, opening possibility of domain hijack using attacks against insecure DNS protocol.

Record
DEBIAN-CVE-2019-10191
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2019-10191 7.5

A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secure domains to DNSSEC-insecure state, opening possibility of domain hijack using attacks against insecure DNS protocol.

Record
UBUNTU-CVE-2019-10191
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.0
6.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVUSN-7047-1 No score

knot-resolver vulnerabilities

Vladimír Čunát discovered that Knot Resolver incorrectly handled input during DNSSEC validation. A remote attacker could possibly use this issue to bypass certain validations. (CVE-2019-10190)

Vladimír Čunát discovered that Knot Resolver incorrectly handled input during DNSSEC validation. A remote attacker could possibly use this issue to downgrade DNSSEC-secure domains to a DNSSEC-insecure state, resulting in a domain hijacking attack. (CVE-2019-10191)

Vladimír Čunát discovered that Knot Resolver incorrectly handled certain DNS replies with many resource records. An attacker could possibly use this issue to consume system resources, resulting in a denial of service. (CVE-2019-19331)

Lior Shafir, Yehuda Afek, and Anat Bremler-Barr discovered that Knot Resolver incorrectly handled certain queries. A remote attacker could use this issue to perform an amplification attack directed at a target. (CVE-2020-12667)

Record
USN-7047-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
knot-resolver
Alpine:v3.11
 before 4.1.0-r0
4.1.0-r0
knot-resolver
Alpine:v3.12
 before 4.1.0-r0
4.1.0-r0
knot-resolver
Alpine:v3.13
 before 4.1.0-r0
4.1.0-r0
knot-resolver
Alpine:v3.14
 before 4.1.0-r0
4.1.0-r0
knot-resolver
Alpine:v3.15
 before 4.1.0-r0
4.1.0-r0
knot-resolver
Alpine:v3.16
 before 4.1.0-r0
4.1.0-r0
knot-resolver
Alpine:v3.17
 before 4.1.0-r0
4.1.0-r0
knot-resolver
Alpine:v3.18
 before 4.1.0-r0
4.1.0-r0
knot-resolver
Alpine:v3.19
 before 4.1.0-r0
4.1.0-r0
knot-resolver
Alpine:v3.20
 before 4.1.0-r0
4.1.0-r0
Show 11 moreShow less
Affected packages
PackageAffectedFixed
knot-resolver
Alpine:v3.21
 before 4.1.0-r0
4.1.0-r0
knot-resolver
Alpine:v3.22
 before 4.1.0-r0
4.1.0-r0
knot-resolver
Alpine:v3.23
 before 4.1.0-r0
4.1.0-r0
knot-resolver
Alpine:v3.24
 before 4.1.0-r0
4.1.0-r0
knot-resolver
Debian:12
 before 5.0.1-1
5.0.1-1
knot-resolver
Debian:13
 before 5.0.1-1
5.0.1-1
knot-resolver
Debian:14
 before 5.0.1-1
5.0.1-1
knot-resolver
Debian:10
 before 3.2.1-3+deb10u2, plus listed versions
3.2.1-33.2.1-3+deb10u1
3.2.1-3+deb10u2
knot-resolver
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.0.0~beta2-123-g6134920-11.0.0~beta3-11.0.0~beta3-1ubuntu0.1~esm1
 None known
knot-resolver
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.3.3-11.5.0-41.5.1-11.5.2-12.0.0-3
Show 4 moreShow less
2.1.0-12.1.0-22.1.1-12.1.1-1ubuntu0.1~esm2
 None known
knot-resolver
Ubuntu:20.04:LTS
 before 3.2.1-3ubuntu2.2, plus listed versions
3.2.1-33.2.1-3ubuntu13.2.1-3ubuntu23.2.1-3ubuntu2.1
3.2.1-3ubuntu2.2

History

History
RecordedChangedSources
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-10191 is a medium vulnerability (CVSS 6.3) in Nic Knot Resolver, published July 10, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.93%, the 80th percentile. Fixed in knot-resolver 4.1.0-r0.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open