[Pkg-rust-maintainers] Bug#1095837: rust-hickory-proto: CVE-2025-25188

[Salvatore Bonaccorso]

Source: rust-hickory-proto
Version: 0.24.1-6
Severity: grave
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for rust-hickory-proto.

CVE-2025-25188[0]:
| Hickory DNS is a Rust based DNS client, server, and resolver. A
| vulnerability present starting in version 0.8.0 and prior to
| versions 0.24.3 and 0.25.0-alpha.5 impacts Hickory DNS users relying
| on DNSSEC verification in the client library, stub resolver, or
| recursive resolver. The DNSSEC validation routines treat entire
| RRsets of DNSKEY records as trusted once they have established trust
| in only one of the DNSKEYs. As a result, if a zone includes a DNSKEY
| with a public key that matches a configured trust anchor, all keys
| in that zone will be trusted to authenticate other records in the
| zone. There is a second variant of this vulnerability involving DS
| records, where an authenticated DS record covering one DNSKEY leads
| to trust in signatures made by an unrelated DNSKEY in the same zone.
| Versions 0.24.3 and 0.25.0-alpha.5 fix the issue.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-25188
    https://www.cve.org/CVERecord?id=CVE-2025-25188
[1] https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-37wc-h8xc-5hc4
[2] https://github.com/hickory-dns/hickory-dns/commit/e118c6eec569f4340421f86ee0686714010c63e9

Regards,
Salvatore