Read the docs
TI-2018-12412 Aliases CVE-2018-17419GHSA-9jcx-pr2f-qvq5

An issue was discovered in setTA in scan_rr.go in the Miek Gieben DNS library before…

Priority LOW 36CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-476.

Summary

An issue was discovered in setTA in scan_rr.go in the Miek Gieben DNS library before 1.0.10 for Go. A dns.ParseZone() parsing error causes a segmentation violation, leading to denial of service.

Why it matters now

EPSS 0.0176 78th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed github.com/miekg/dns (Go): 1.0.10Red Hat: 5 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/miekg/dns (Go)before 1.0.101.0.10Patch availableGHSA-9jcx-pr2f-qvq5
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/miekg/dns (Go) Vendor— Affected before 1.0.10 Fixed in 1.0.10 Patch available GHSA-9jcx-pr2f-qvq5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dns_library_project:dns_library:*:*:*:*:*:*:*:*before 1.0.10VulnerableDns Library Project
  • cpe:2.3:a:dns_library_project:dns_library:*:*:*:*:*:*:*:* Versions before 1.0.10 Vulnerable ·Dns Library Project

Remediation

  • Fix · GHSA-9jcx-pr2f-qvq5 github.com/miekg/dns (Go) Fixed in 1.0.10 Advisory →

Red Hat 5 advisories

  • RHSA-2023:5006 Released 2023-10-31 · Red Hat rating Important
    OpenShift Container Platform 4.14.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
  • RHSA-2023:3363 Released 2023-06-07 · Red Hat rating Moderate
    OpenShift Container Platform 4.10.61 bug fix and security update
    • Red Hat OpenShift Container Platform 4.10 openshift4/ose-kube-proxy
  • RHSA-2023:3309 Released 2023-05-31 · Red Hat rating Moderate
    OpenShift Container Platform 4.11.42 bug fix and security update
    • Red Hat OpenShift Container Platform 4.11 openshift4/ose-kube-proxy
Show 2 more Red Hat advisories
  • RHSA-2023:3287 Released 2023-05-31 · Red Hat rating Moderate
    OpenShift Container Platform 4.12.19 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/ose-kube-proxy
  • RHSA-2023:3304 Released 2023-05-30 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.1 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/network-tools-rhel8, openshift4/oc-mirror-plugin-rhel8 +42

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2023:3363
Red Hat OpenShift Container Platform 4.11Fixed RHSA-2023:3309
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2023:3287
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2023:3304
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2023:5006
Not affected: 38 products
  • Cost Management Metrics Operator
  • Cryostat 2
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • Logging Subsystem for Red Hat OpenShift
  • Migration Toolkit for Containers
  • Migration Toolkit for Virtualization
  • Node Maintenance Operator
  • OpenShift API for Data Protection
  • OpenShift Secondary Scheduler Operator
  • OpenShift Serverless
  • OpenShift Service Mesh 2
  • OpenShift Service Mesh 2.1
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 3
  • Red Hat Advanced Cluster Security 4
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.10
  • Red Hat OpenShift Container Platform 4.11
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform Assisted Installer 1
  • Red Hat OpenShift Data Science (RHODS)
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift distributed tracing 2
  • Red Hat OpenStack Platform 16.2
  • Red Hat Openshift Container Storage 4
  • Red Hat Openshift Data Foundation 4
  • Red Hat Openshift Sandboxed Containers
  • Red Hat Quay 3
  • Red Hat Storage 3
  • cert-manager Operator for Red Hat OpenShift
  • mirror registry for Red Hat OpenShift

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-17419
  2. 2026-10-03 Alias added: GHSA-9jcx-pr2f-qvq5

References

Exploit 1

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences