Red Hat Security Advisory: dnsmasq security update

Fixed packages 5

Vulnerabilities 4

• High 7.5
  CVE-2022-0934

  A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a c…

  dnsmasq dnsmasq dnsmasq dnsmasq Debian Ubuntu Azure Linux Alpine
  Aug 29, 2022
• High 7.5
  CVE-2023-28450

  An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should b…

  dnsmasq dnsmasq dnsmasq dnsmasq Debian Ubuntu Azure Linux Alpine
  Mar 15, 2023
• High 7.5
  CVE-2023-50387 Public exploit EPSS 100%

  Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to …

  bind9 bind9 bind unbound Debian Ubuntu Azure Linux Alpine Wolfi
  Feb 14, 2024
• High 7.5
  CVE-2023-50868 Public exploit EPSS 74%

  The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote att…

  bind9 bind9 bind unbound Debian Ubuntu Azure Linux Alpine Wolfi
  Feb 14, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2057075
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2178948
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2263914
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2263917
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1545.json
• report
  https://access.redhat.com/security/cve/CVE-2022-0934
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-0934
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-0934
• article
  https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016272.html
• report
  https://access.redhat.com/security/cve/CVE-2023-28450
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-28450
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-28450
• advisory
  https://github.com/advisories/GHSA-vgrx-vhjf-p7wv
• report
  https://access.redhat.com/security/cve/CVE-2023-50387
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-50387
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-50387
• article
  https://blog.powerdns.com/2024/02/13/powerdns-recursor-4-8-6-4-9-3-5-0-2-released
• article
  https://kb.isc.org/docs/cve-2023-50387
• article
  https://www.knot-resolver.cz/2024-02-13-knot-resolver-5.7.1.html
• report
  https://access.redhat.com/security/cve/CVE-2023-50868
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-50868
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-50868
• article
  https://kb.isc.org/docs/cve-2023-50868