CVE-2023-7008: systemd_project systemd Channel Accessible by Non-Endpoint

Vulnerability summary

CVE-2023-7008 is a medium (CVSS 5.9) Channel Accessible by Non-Endpoint vulnerability in systemd_project systemd. EPSS estimates a 0.85% chance of exploitation in the next 30 days, higher than 57.4% of scored vulnerabilities.

Timeline

1. 23-12-2023
   PublishedVulnerability first disclosed.
2. 14-10-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.

• CWE-300Channel Accessible by Non-EndpointThe product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.