CVE-2017-11104
Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol...
Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set, because of an improper TSIG validity period check.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set, because of an improper TSIG validity period check.
- Record
CVE-2017-11104- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set, because of an improper TSIG validity period check.
- Record
CVE-2017-11104- Updated
- 2026-11-02
EUVDEUVD-2017-2741 No score
Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set, because of an improper TSIG validity period check.
- Record
EUVD-2017-2741- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xhxv-xr8w-7xpm
Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol...
Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set, because of an improper TSIG validity period check.
- Record
GHSA-xhxv-xr8w-7xpm- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set, because of an improper TSIG validity period check.
- Record
CVE-2017-11104- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-11104
Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set, because of an improper TSIG validity period check.
- Record
DEBIAN-CVE-2017-11104- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2017-11104
Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set, because of an improper TSIG validity period check.
- Record
UBUNTU-CVE-2017-11104- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1085-1 No score
Security update for knot
This update for knot fixes the following issues:
- CVE-2017-11104: Fixed an improper implementation of TSIG protocol which could have allowed an attacker with a valid key name and algorithm to bypass TSIG authentication (boo#1047841).
- Record
openSUSE-SU-2020:1085-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1086-1 No score
Security update for knot
This update for knot fixes the following issues:
- CVE-2017-11104: Fixed an improper implementation of TSIG protocol which could have allowed an attacker with a valid key name and algorithm to bypass TSIG authentication (boo#1047841).
- Record
openSUSE-SU-2020:1086-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1112-1 No score
Security update for knot
This update for knot fixes the following issues:
- CVE-2017-11104: Fixed an improper implementation of TSIG protocol which could have allowed an attacker with a valid key name and algorithm to bypass TSIG authentication (boo#1047841).
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2020:1112-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1232-1 No score
Security update for knot
This update for knot fixes the following issues:
- CVE-2017-11104: Fixed an improper implementation of TSIG protocol which could have allowed an attacker with a valid key name and algorithm to bypass TSIG authentication (boo#1047841).
This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2020:1232-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
knotDebian:12 |
before 2.5.3-1 | 2.5.3-1 |
knotDebian:13 |
before 2.5.3-1 | 2.5.3-1 |
knotDebian:14 |
before 2.5.3-1 | 2.5.3-1 |
knotDebian:8 |
before 1.6.0-1+deb8u1, plus listed versions 1.6.0-1 |
1.6.0-1+deb8u1 |
knotDebian:9 |
before 2.4.0-3+deb9u1, plus listed versions 2.4.0-3 |
2.4.0-3+deb9u1 |
knotUbuntu:16.04:LTS |
All versions, plus listed versions 2.0.0-12.0.1-42.0.1-4build12.0.2-12.0.2-1build1 Show 6 moreShow less2.1.0~rc1-52-gd80ce77-12.1.0~rc1-55-gf227348-12.1.0-22.1.0-32.1.1-12.1.1-1build1 |
None known |
knotopenSUSE:Leap 15.1 |
before 1.6.8-lp151.4.3.1 | 1.6.8-lp151.4.3.1 |
knotopenSUSE:Leap 15.2 |
before 1.6.8-lp152.5.3.1 | 1.6.8-lp152.5.3.1 |
knotSUSE:Package Hub 15 SP1 |
before 1.6.8-bp151.4.3.1 | 1.6.8-bp151.4.3.1 |
knotSUSE:Package Hub 15 SP2 |
before 1.6.8-bp152.4.3.1 | 1.6.8-bp152.4.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-11104 is a medium vulnerability (CVSS 5.9) in Knot-dns Knot Dns, published July 8, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.68%, the 85th percentile. Fixed in knot 2.5.3-1.
References
debian.org/security/2017/dsa-3910
securityfocus.com/bid/99598
bugs.debian.org/865678
synacktiv.ninja/ressources/Knot_DNS_TSIG_Signature_Forgery.pdf
lists.nic.cz/pipermail/knot-dns-users/2017-June/001144.html
lists.opensuse.org/opensuse-security-announce/2020-07/msg00078.html
Show 14 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-11104
github.com/advisories/GHSA-xhxv-xr8w-7xpm
security-tracker.debian.org/tracker/CVE-2017-11104
ubuntu.com/security/CVE-2017-11104
cve.org/CVERecord?id=CVE-2017-11104
bugzilla.suse.com/1047841
suse.com/security/cve/CVE-2017-11104