Lucene search

AmazonALAS2-2023-2069

HistoryJun 05, 2023 - 4:39 p.m.

Medium: dnsmasq

2023-06-0516:39:00

alas.aws.amazon.com

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.6 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

61.8%

JSON

Issue Overview:

An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. (CVE-2023-28450)

Affected Packages:

dnsmasq

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update dnsmasq to update your system.

New Packages:

aarch64:  
    dnsmasq-2.76-16.amzn2.1.4.aarch64  
    dnsmasq-utils-2.76-16.amzn2.1.4.aarch64  
    dnsmasq-debuginfo-2.76-16.amzn2.1.4.aarch64  
  
i686:  
    dnsmasq-2.76-16.amzn2.1.4.i686  
    dnsmasq-utils-2.76-16.amzn2.1.4.i686  
    dnsmasq-debuginfo-2.76-16.amzn2.1.4.i686  
  
src:  
    dnsmasq-2.76-16.amzn2.1.4.src  
  
x86_64:  
    dnsmasq-2.76-16.amzn2.1.4.x86_64  
    dnsmasq-utils-2.76-16.amzn2.1.4.x86_64  
    dnsmasq-debuginfo-2.76-16.amzn2.1.4.x86_64

Additional References

Red Hat: CVE-2023-28450

Mitre: CVE-2023-28450

OSVersionArchitecturePackageVersionFilename
Amazon Linux2aarch64dnsmasq< 2.76-16.amzn2.1.4dnsmasq-2.76-16.amzn2.1.4.aarch64.rpm
Amazon Linux2aarch64dnsmasq-utils< 2.76-16.amzn2.1.4dnsmasq-utils-2.76-16.amzn2.1.4.aarch64.rpm
Amazon Linux2aarch64dnsmasq-debuginfo< 2.76-16.amzn2.1.4dnsmasq-debuginfo-2.76-16.amzn2.1.4.aarch64.rpm
Amazon Linux2i686dnsmasq< 2.76-16.amzn2.1.4dnsmasq-2.76-16.amzn2.1.4.i686.rpm
Amazon Linux2i686dnsmasq-utils< 2.76-16.amzn2.1.4dnsmasq-utils-2.76-16.amzn2.1.4.i686.rpm
Amazon Linux2i686dnsmasq-debuginfo< 2.76-16.amzn2.1.4dnsmasq-debuginfo-2.76-16.amzn2.1.4.i686.rpm
Amazon Linux2x86_64dnsmasq< 2.76-16.amzn2.1.4dnsmasq-2.76-16.amzn2.1.4.x86_64.rpm
Amazon Linux2x86_64dnsmasq-utils< 2.76-16.amzn2.1.4dnsmasq-utils-2.76-16.amzn2.1.4.x86_64.rpm
Amazon Linux2x86_64dnsmasq-debuginfo< 2.76-16.amzn2.1.4dnsmasq-debuginfo-2.76-16.amzn2.1.4.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	2	aarch64	dnsmasq	< 2.76-16.amzn2.1.4	dnsmasq-2.76-16.amzn2.1.4.aarch64.rpm
Amazon Linux	2	aarch64	dnsmasq-utils	< 2.76-16.amzn2.1.4	dnsmasq-utils-2.76-16.amzn2.1.4.aarch64.rpm
Amazon Linux	2	aarch64	dnsmasq-debuginfo	< 2.76-16.amzn2.1.4	dnsmasq-debuginfo-2.76-16.amzn2.1.4.aarch64.rpm
Amazon Linux	2	i686	dnsmasq	< 2.76-16.amzn2.1.4	dnsmasq-2.76-16.amzn2.1.4.i686.rpm
Amazon Linux	2	i686	dnsmasq-utils	< 2.76-16.amzn2.1.4	dnsmasq-utils-2.76-16.amzn2.1.4.i686.rpm
Amazon Linux	2	i686	dnsmasq-debuginfo	< 2.76-16.amzn2.1.4	dnsmasq-debuginfo-2.76-16.amzn2.1.4.i686.rpm
Amazon Linux	2	x86_64	dnsmasq	< 2.76-16.amzn2.1.4	dnsmasq-2.76-16.amzn2.1.4.x86_64.rpm
Amazon Linux	2	x86_64	dnsmasq-utils	< 2.76-16.amzn2.1.4	dnsmasq-utils-2.76-16.amzn2.1.4.x86_64.rpm
Amazon Linux	2	x86_64	dnsmasq-debuginfo	< 2.76-16.amzn2.1.4	dnsmasq-debuginfo-2.76-16.amzn2.1.4.x86_64.rpm