HCE2-SA-2024-0172 Important HCE 2.0 Security Fix(es): Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records. (CVE-2023-50387) The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868) HCE 2.0 systemd-249-16.r75.hce2.aarch64.rpm systemd-container-249-16.r75.hce2.aarch64.rpm systemd-devel-249-16.r75.hce2.aarch64.rpm systemd-help-249-16.r75.hce2.noarch.rpm systemd-libs-249-16.r75.hce2.aarch64.rpm systemd-networkd-249-16.r75.hce2.aarch64.rpm systemd-nspawn-249-16.r75.hce2.aarch64.rpm systemd-pam-249-16.r75.hce2.aarch64.rpm systemd-resolved-249-16.r75.hce2.aarch64.rpm systemd-timesyncd-249-16.r75.hce2.aarch64.rpm systemd-udev-249-16.r75.hce2.aarch64.rpm systemd-udev-compat-249-16.r75.hce2.aarch64.rpm systemd-249-16.r75.hce2.x86_64.rpm systemd-container-249-16.r75.hce2.x86_64.rpm systemd-devel-249-16.r75.hce2.x86_64.rpm systemd-libs-249-16.r75.hce2.x86_64.rpm systemd-networkd-249-16.r75.hce2.x86_64.rpm systemd-nspawn-249-16.r75.hce2.x86_64.rpm systemd-pam-249-16.r75.hce2.x86_64.rpm systemd-resolved-249-16.r75.hce2.x86_64.rpm systemd-timesyncd-249-16.r75.hce2.x86_64.rpm systemd-udev-249-16.r75.hce2.x86_64.rpm systemd-udev-compat-249-16.r75.hce2.x86_64.rpm