Lucene search

K
mageiaGentoo FoundationMGASA-2024-0041
HistoryFeb 18, 2024 - 4:49 a.m.

Updated dnsmasq packages fix security vulnerabilities

2024-02-1804:49:05
Gentoo Foundation
advisories.mageia.org
62
dnsmasq
security vulnerabilities
dns protocol
denial of service
remote attacker
resource consumption
dnssec
keytrap
nsec3
cpu exhaustion
udp packet size
segfault
caching
update

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.2

Confidence

Low

EPSS

0.05

Percentile

92.9%

This updated dnsmasq package fixes security issues: Certain DNSSEC aspects of the DNS protocol allow a remote attacker to trigger a denial of service via extreme consumption of resource caused by DNSSEC query or response: - KeyTrap - Extreme CPU consumption in DNSSEC validator. (CVE-2023-50387) - Preparing an NSEC3 closest encloser proof can exhaust CPU resources. (CVE-2023-50868) This update also fixes issues with udp packet size (fix already present in mageia package for 2.89), possible segfault and caching.

OSVersionArchitecturePackageVersionFilename
Mageia9noarchdnsmasq< 2.90-1dnsmasq-2.90-1.mga9

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.2

Confidence

Low

EPSS

0.05

Percentile

92.9%