CVE-2023-28450

An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.

CVSS v3.0 7.5 HIGH

7.5^/10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=blob;f=CHANGELOG	Release Notes
https://capec.mitre.org/data/definitions/495.html	Not Applicable
https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=eb92fb32b746f2104b0f370b5b295bb8dd4bd5e5	Patch
https://thekelleys.org.uk/dnsmasq/doc.html	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:*

Information

Published : 2023-03-15 14:15

Updated : 2023-03-21 12:24

NVD link : CVE-2023-28450

Mitre link : CVE-2023-28450

JSON object : View

CWE

NVD-CWE-noinfo

Products Affected

thekelleys

dnsmasq

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=blob;f=CHANGELOG", "name": "https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=blob;f=CHANGELOG", "tags": ["Release Notes"], "refsource": "MISC"}, {"url": "https://capec.mitre.org/data/definitions/495.html", "name": "https://capec.mitre.org/data/definitions/495.html", "tags": ["Not Applicable"], "refsource": "MISC"}, {"url": "https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=eb92fb32b746f2104b0f370b5b295bb8dd4bd5e5", "name": "https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=eb92fb32b746f2104b0f370b5b295bb8dd4bd5e5", "tags": ["Patch"], "refsource": "MISC"}, {"url": "https://thekelleys.org.uk/dnsmasq/doc.html", "name": "https://thekelleys.org.uk/dnsmasq/doc.html", "tags": ["Product"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2023-28450", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}}, "publishedDate": "2023-03-15T21:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2.90"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-03-21T19:24Z"}

7.5 /10