CVE-2023-41045

CVE-2023-41045 affects Graylog: insecure, single-source-port usage for DNS queries. The issue stems from binding a single outgoing DNS socket to a random port that is never rotated, increasing susceptibility to forged DNS responses and cache poisoning. Impact is described as potential poisoning r...

CVE-2023-41045 Insecure source port usage for DNS queries in Graylog

Graylog is a free and open log management platform. Graylog makes use of only one single source port for DNS queries. Graylog binds a single socket for outgoing DNS queries and while that socket is bound to a random port number it is never changed again. This goes against recommended practice sin...

org.graylog.plugins:usage-statistics (>=1.1.2, <=2.1.2) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (2.1.2)

org.graylog2:graylog2-server MAVEN version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:usage-statistics =1.1.2, =2.1.2 Source cves: CVE-2023-41045 Source advisory:...

org.graylog.plugins:graylog-plugin-parent (4.3.0), org.graylog.plugins:graylog-plugin-web-parent (4.3.0) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (4.3.0)

org.graylog2:graylog2-server MAVEN version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 4.3.0 - org.graylog.plugins:graylog-plugin-web-parent 4.3.0...

org.graylog.plugins:usage-statistics (2.1.0-beta.3) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (2.1.0-beta.3)

org.graylog2:graylog2-server MAVEN version 2.1.0-beta.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:usage-statistics 2.1.0-beta.3 Source cves: CVE-2023-41045 Source advisory:...

org.graylog.plugins:graylog-plugin-parent (2.4.0-rc.2), org.graylog.plugins:graylog-plugin-pipeline-processor (2.4.0-rc.2) +2 more potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (2.4.0-rc.2)

org.graylog2:graylog2-server MAVEN version 2.4.0-rc.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 2.4.0-rc.2 -...

org.graylog.plugins:usage-statistics (2.0.0-alpha.2) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (2.0.0-alpha.2)

org.graylog2:graylog2-server MAVEN version 2.0.0-alpha.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:usage-statistics 2.0.0-alpha.2 Source cves: CVE-2023-41045 Source advisory:...

com.airbus-cyber-security.graylog:graylog-plugin-glpi (1.4.0), org.graylog.plugins:graylog-plugin-parent (3.2.2) +1 more potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (3.2.2)

org.graylog2:graylog2-server MAVEN version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - com.airbus-cyber-security.graylog:graylog-plugin-glpi 1.4.0 - org.graylog.plugins:graylog-plugin-parent...

org.graylog.plugins:graylog-plugin-parent (3.2.4), org.graylog.plugins:graylog-plugin-web-parent (3.2.4) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (3.2.4)

org.graylog2:graylog2-server MAVEN version 3.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 3.2.4 - org.graylog.plugins:graylog-plugin-web-parent 3.2.4...

org.graylog.plugins:graylog-plugin-parent (2.2.0), org.graylog.plugins:graylog-plugin-pipeline-processor (2.2.0) +2 more potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (2.2.0)

org.graylog2:graylog2-server MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 2.2.0 - org.graylog.plugins:graylog-plugin-pipeline-processor...

org.graylog.plugins:graylog-plugin-parent (2.2.0-rc.1), org.graylog.plugins:graylog-plugin-pipeline-processor (2.2.0-rc.1) +2 more potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (2.2.0-rc.1)

org.graylog2:graylog2-server MAVEN version 2.2.0-rc.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 2.2.0-rc.1 -...

org.graylog.plugins:graylog-plugin-parent (3.1.0), org.graylog.plugins:graylog-plugin-web-parent (3.1.0) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (3.1.0)

org.graylog2:graylog2-server MAVEN version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 3.1.0 - org.graylog.plugins:graylog-plugin-web-parent 3.1.0...

org.graylog.plugins:graylog-plugin-parent (2.3.1), org.graylog.plugins:graylog-plugin-pipeline-processor (2.3.1) +2 more potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (2.3.1)

org.graylog2:graylog2-server MAVEN version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 2.3.1 - org.graylog.plugins:graylog-plugin-pipeline-processor...

org.graylog.plugins:graylog-plugin-parent (2.2.0-beta.2), org.graylog.plugins:graylog-plugin-pipeline-processor (2.2.0-beta.2) +2 more potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (2.2.0-beta.2)

org.graylog2:graylog2-server MAVEN version 2.2.0-beta.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 2.2.0-beta.2 -...

org.graylog.plugins:graylog-plugin-parent (4.3.13), org.graylog.plugins:graylog-plugin-web-parent (4.3.13) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (4.3.13)

org.graylog2:graylog2-server MAVEN version 4.3.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 4.3.13 - org.graylog.plugins:graylog-plugin-web-parent 4.3.1...

org.graylog.plugins:graylog-plugin-parent (3.3.0), org.graylog.plugins:graylog-plugin-web-parent (3.3.0) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (3.3.0)

org.graylog2:graylog2-server MAVEN version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 3.3.0 - org.graylog.plugins:graylog-plugin-web-parent 3.3.0...

org.graylog.plugins:graylog-plugin-parent (3.0.0-beta.1), org.graylog.plugins:graylog-plugin-web-parent (3.0.0-beta.1) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (3.0.0-beta.1)

org.graylog2:graylog2-server MAVEN version 3.0.0-beta.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 3.0.0-beta.1 -...

org.graylog2:graylog2-rest-routes (1.3.0-beta.2) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (1.3.0-beta.2)

org.graylog2:graylog2-server MAVEN version 1.3.0-beta.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog2:graylog2-rest-routes 1.3.0-beta.2 Source cves: CVE-2023-41045 Source advisory:...

org.graylog2:graylog2-rest-routes (1.2.2) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (1.2.2)

org.graylog2:graylog2-server MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog2:graylog2-rest-routes 1.2.2 Source cves: CVE-2023-41045 Source advisory:...

org.graylog.plugins:graylog-plugin-parent (3.3.0-rc.1), org.graylog.plugins:graylog-plugin-web-parent (3.3.0-rc.1) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (3.3.0-rc.1)

org.graylog2:graylog2-server MAVEN version 3.3.0-rc.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 3.3.0-rc.1 - org.graylog.plugins:graylog-plugin-web-pare...