GHSA-G96C-X7RH-99R3 Graylog vulnerable to insecure source port usage for DNS queries

Summary Graylog utilises only one single source port for DNS queries. Details Graylog seems to bind a single socket for outgoing DNS queries. That socket is bound to a random port number which is not changed again. This goes against recommended practice since 2008, when Dan Kaminsky discovered ho...

org.graylog.telemetry:graylog-telemetry-plugin (1.0.0) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (1.0.0-rc.4)

org.graylog2:graylog2-server MAVEN version 1.0.0-rc.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.telemetry:graylog-telemetry-plugin 1.0.0 Source cves: CVE-2023-41045 Source advisory:...

org.graylog.plugins:graylog-plugin-parent (2.3.0-alpha.2), org.graylog.plugins:graylog-plugin-pipeline-processor (2.3.0-alpha.2) +2 more potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (2.3.0-alpha.2)

org.graylog2:graylog2-server MAVEN version 2.3.0-alpha.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 2.3.0-alpha.2 -...

org.graylog.plugins:graylog-plugin-parent (2.2.0-alpha.1), org.graylog.plugins:graylog-plugin-web-parent (2.2.0-alpha.1) +1 more potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (2.2.0-alpha.1)

org.graylog2:graylog2-server MAVEN version 2.2.0-alpha.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 2.2.0-alpha.1 -...

org.graylog.plugins:graylog-plugin-parent (4.2.8), org.graylog.plugins:graylog-plugin-web-parent (4.2.8) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (4.2.8)

org.graylog2:graylog2-server MAVEN version 4.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 4.2.8 - org.graylog.plugins:graylog-plugin-web-parent 4.2.8...

org.graylog.plugins:graylog-plugin-parent (4.0.7), org.graylog.plugins:graylog-plugin-web-parent (4.0.7) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (4.0.7)

org.graylog2:graylog2-server MAVEN version 4.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 4.0.7 - org.graylog.plugins:graylog-plugin-web-parent 4.0.7...

org.graylog.plugins:graylog-plugin-parent (3.3.0-rc.1), org.graylog.plugins:graylog-plugin-web-parent (3.3.0-rc.1) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (3.3.0-rc.1)

org.graylog2:graylog2-server MAVEN version 3.3.0-rc.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 3.3.0-rc.1 - org.graylog.plugins:graylog-plugin-web-pare...

org.graylog.plugins:graylog-plugin-parent (3.1.1), org.graylog.plugins:graylog-plugin-web-parent (3.1.1) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (3.1.1)

org.graylog2:graylog2-server MAVEN version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 3.1.1 - org.graylog.plugins:graylog-plugin-web-parent 3.1.1...

org.graylog2:graylog2-rest-routes (1.2.2) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (1.2.2)

org.graylog2:graylog2-server MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog2:graylog2-rest-routes 1.2.2 Source cves: CVE-2023-41045 Source advisory:...

org.graylog.plugins:graylog-plugin-parent (4.1.8), org.graylog.plugins:graylog-plugin-web-parent (4.1.8) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (4.1.8)

org.graylog2:graylog2-server MAVEN version 4.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 4.1.8 - org.graylog.plugins:graylog-plugin-web-parent 4.1.8...

org.graylog.plugins:graylog-plugin-parent (3.1.2), org.graylog.plugins:graylog-plugin-web-parent (3.1.2) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (3.1.2)

org.graylog2:graylog2-server MAVEN version 3.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 3.1.2 - org.graylog.plugins:graylog-plugin-web-parent 3.1.2...

org.graylog.plugins:graylog-plugin-parent (3.0.0-alpha.3), org.graylog.plugins:graylog-plugin-web-parent (3.0.0-alpha.3) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (3.0.0-alpha.3)

org.graylog2:graylog2-server MAVEN version 3.0.0-alpha.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 3.0.0-alpha.3 -...

org.graylog.plugins:graylog-plugin-parent (4.1.14), org.graylog.plugins:graylog-plugin-web-parent (4.1.14) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (4.1.14)

org.graylog2:graylog2-server MAVEN version 4.1.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 4.1.14 - org.graylog.plugins:graylog-plugin-web-parent 4.1.1...

org.graylog.plugins:graylog-plugin-parent (2.2.0-alpha.4), org.graylog.plugins:graylog-plugin-web-parent (2.2.0-alpha.4) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (2.2.0-alpha.4)

org.graylog2:graylog2-server MAVEN version 2.2.0-alpha.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 2.2.0-alpha.4 -...

org.graylog.plugins:graylog-plugin-parent (3.1.0), org.graylog.plugins:graylog-plugin-web-parent (3.1.0) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (3.1.0)

org.graylog2:graylog2-server MAVEN version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 3.1.0 - org.graylog.plugins:graylog-plugin-web-parent 3.1.0...

org.graylog.plugins:graylog-plugin-parent (3.0.0-alpha.4), org.graylog.plugins:graylog-plugin-web-parent (3.0.0-alpha.4) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (3.0.0-alpha.4)

org.graylog2:graylog2-server MAVEN version 3.0.0-alpha.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 3.0.0-alpha.4 -...

org.graylog.plugins:graylog-plugin-parent (4.1.5), org.graylog.plugins:graylog-plugin-web-parent (4.1.5) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (4.1.5)

org.graylog2:graylog2-server MAVEN version 4.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 4.1.5 - org.graylog.plugins:graylog-plugin-web-parent 4.1.5...

org.graylog.plugins:graylog-plugin-parent (3.3.14), org.graylog.plugins:graylog-plugin-web-parent (3.3.14) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (3.3.14)

org.graylog2:graylog2-server MAVEN version 3.3.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 3.3.14 - org.graylog.plugins:graylog-plugin-web-parent 3.3.1...

org.graylog.plugins:graylog-plugin-parent (3.0.0-rc.2), org.graylog.plugins:graylog-plugin-web-parent (3.0.0-rc.2) potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (3.0.0-rc.2)

org.graylog2:graylog2-server MAVEN version 3.0.0-rc.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - org.graylog.plugins:graylog-plugin-parent 3.0.0-rc.2 - org.graylog.plugins:graylog-plugin-web-pare...

com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count (>=4.0.0, <=4.0.2), com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=4.0.0, <=4.0.2) +4 more potentially affected by CVE-2023-41045 via org.graylog2:graylog2-server (4.1.2)

org.graylog2:graylog2-server MAVEN version 4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count =4.0.0, =4.0.0, =4.0.0, =4.0.1, =4.0...