Medium severity · published Aug 31, 2017
CVE-2015-5695
Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas when processing an internal zone file…
6.5
CVSS
2.1%
EPSS
No
On KEV
Description
Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas when processing an internal zone file transfer, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted resource record set.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
Designate · Openstack
1.0.0.0b1; 1.0.0a0; 2015.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5695
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5695
Patch
http://lists.openstack.org/pipermail/openstack/2015-July/013548.html
Mailing List
http://www.openwall.com/lists/oss-security/2015/07/28/11
Mailing List
http://www.openwall.com/lists/oss-security/2015/07/29/6
Exploit
https://bugs.launchpad.net/designate/+bug/1471161
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1245241
Mailing List
https://launchpadlibrarian.net/211525251/bug-1471161-quotas-master.patch
More from Designate
9.6
CVE-2026-71193
In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only
6.8
CVE-2026-71194
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests
6.5
CVE-2015-5694
Designate does not enforce the DNS protocol limit concerning record set sizes