GeezerVison is showing github.com — DNSSEC security audit · Issue #263 · dnsjava/dnsjava
DNSSEC security audit #263DescriptionHey folks,
Since we're going to be using dnsjava in VeraId, I'm planning to request an independent security audit of your DNSSEC implementation, but I have a few questions I was hoping you could answer:
- Has there been any independent assessment of the DNSSEC implementation and, if so, is the report public? I couldn't find any reference to security audits but I wanted to double check.
- Would you be happy to engage directly with the team conducting the audit? It's unclear at this point whether this would be necessary or ideal. The alternative is to communicate the findings to me, and I'll pass them on to you.
- What's the best way to report security vulnerabilities? Assuming they find any and I'm the "liaison".
Thanks! Activityibauersachs commented on Sep 23, 2022 Hi, I would welcome an external security audit. So thanks in advance for arranging something.
- No, there has not been any external audit.
- Yes, feel free to contact me either here on GitHub via mentioning or you can find my e-mail address on my profile.
- I guess that would depend on the criticality. Low-impact stuff can probably be a public GitHub issue, otherwise please just drop me an e-mail.
Large parts of the DNSSEC code in dnsjava served as the prototype for the validator in Unbound, and you can still find identical comments in both code bases. Please let this know anyone doing the audit. A bug in Unbound's validator is likely to affect dnsjava as well. CVE-2017-15105 was such an example. nresare commented on Sep 23, 2022 As another developer with admin rights that is mostly absent (sorry) I also welcome an audit. For time sensitive issued feel free to reach out. gnarea commented on Sep 26, 2022 Thank you so much @ibauersachs and @nresare! That's really helpful.
I'll be applying for the audit in a few weeks, and it'll be part of a much bigger assessment of our projects and their key dependencies, so it might take 1-2 months to get it approved and maybe an extra month for the 3rd party auditors to start their work... So it'll probably happen early next year. I'll keep you posted. ibauersachs commented on Aug 1, 2023 @gnarea Is there any feedback you can share? gnarea commented on Aug 2, 2023 @ibauersachs, I had to defer the application once again, but I recently started the process and expect to complete it within a couple of weeks. Once I've submitted it, it'll take weeks or maybe months until it's approved. Reacted by Ingo Bauersachs gnarea commented on Sep 30, 2023 Hey folks. I finally got round to requesting the security earlier this week. I'll let you know when they're ready to start. It'll probably be in a few months. Reacted by Ingo Bauersachs ibauersachs commented on Sep 8, 2024 Another year has almost passed. Do you have anything to share? gnarea commented on Sep 9, 2024 Sorry, I forgot to post an update. Due to delays with the commissioning process, the team doing the audit only just started a few weeks ago. Third party dependencies will be assessed last, so the respective reports will be available near the end of the year or early next year. phax commented on Sep 24, 2025 Now I got curious as well ;-) Did you had some findings? gnarea commented on Oct 25, 2025 Hi everyone. I'm afraid that we lost the funding before the penetration testers got to dnsjava. Reacted by Philip Helger and Sten T.
MetadataMetadataDevelopmentNo branches or pull requestsIssue actions
|