Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2025:0071-1

Опубликовано: 10 янв. 2025
Источник: suse-cvrf

Описание

Security update for dnsmasq

This update for dnsmasq fixes the following issues:

  • Version update to 2.90:
  • CVE-2023-50387: Fixed a Denial Of Service while trying to validate specially crafted DNSSEC responses. (bsc#1219823)
  • CVE-2023-50868: Fixed a Denial Of Service while trying to validate specially crafted DNSSEC responses. (bsc#1219826)
  • CVE-2023-28450: Default maximum EDNS.0 UDP packet size should be 1232. (bsc#1209358)

Список пакетов

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise Micro 5.3
dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise Micro 5.4
dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise Micro 5.5
dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise Module for Basesystem 15 SP6
dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise Server 15 SP4-LTSS
dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise Server 15 SP5-LTSS
dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4
dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5
dnsmasq-2.90-150400.16.3.1
SUSE Manager Proxy 4.3
dnsmasq-2.90-150400.16.3.1
SUSE Manager Server 4.3
dnsmasq-2.90-150400.16.3.1
openSUSE Leap 15.6
dnsmasq-2.90-150400.16.3.1
dnsmasq-utils-2.90-150400.16.3.1
openSUSE Leap Micro 5.5
dnsmasq-2.90-150400.16.3.1

Ссылки

Описание

An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.

Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:dnsmasq-2.90-150400.16.3.1
Ссылки

Описание

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:dnsmasq-2.90-150400.16.3.1
Ссылки

Описание

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:dnsmasq-2.90-150400.16.3.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:dnsmasq-2.90-150400.16.3.1
Ссылки