Описание
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, and gRPC) because it trusts the transport writer's TsigStatus() instead of performing verification itself. The DoH and DoH3 writer's TsigStatus() always returns nil, the DoT server does not set TsigSecret on the dns.Server, and the DoQ and gRPC writers also unconditionally return nil. This allows an unauthenticated remote client to bypass TSIG-based authentication and access resources intended to be restricted behind a tsig require all policy. Plain DNS over TCP and UDP are not affected. This issue has been fixed in version 1.14.3.
A flaw was found in CoreDNS, a DNS server that chains plugins. An unauthenticated remote client can bypass TSIG (Transaction Signature) based authentication on non-plain-DNS transports such as DNS over TLS (DoT), DNS over HTTPS (DoH), DNS over HTTP/3 (DoH3), DNS over QUIC (DoQ), and gRPC. This bypass occurs because the tsig plugin incorrectly trusts the transport writer's status instead of performing its own verification. This allows unauthorized access to resources that should be restricted by TSIG policies.
Отчет
The tsig plugin code is compiled into the CoreDNS binary shipped in Red Hat products, but is not enabled in default product configurations. The OpenShift DNS Operator does not include the tsig directive in the generated Corefile, and does not configure non-plain-DNS transport listeners (DoT, DoH, DoH3, DoQ, or gRPC) required to trigger this vulnerability. As a result, the vulnerable code path is not reachable in standard deployments, reducing the practical impact to Low for affected Red Hat products despite the upstream CVSSv3 score of 7.5.
Меры по смягчению последствий
If you have enabled the tsig plugin in CoreDNS with non-plain-DNS transports (DoT, DoH, DoH3, DoQ, or gRPC), disable those transports or restrict network access to the DNS service until the fix is applied. Plain DNS over TCP and UDP is not affected by this vulnerability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/lighthouse-agent-rhel9 | Fix deferred | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/lighthouse-coredns-rhel9 | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-coredns | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-coredns-rhel9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, and gRPC) because it trusts the transport writer's TsigStatus() instead of performing verification itself. The DoH and DoH3 writer's TsigStatus() always returns nil, the DoT server does not set TsigSecret on the dns.Server, and the DoQ and gRPC writers also unconditionally return nil. This allows an unauthenticated remote client to bypass TSIG-based authentication and access resources intended to be restricted behind a tsig require all policy. Plain DNS over TCP and UDP are not affected. This issue has been fixed in version 1.14.3.
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14 ...
CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC
EPSS
7.5 High
CVSS3