SUSE CVE-2023-28452

An issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing denial of service for normal resolution. In an exploit, the attacker could just forge a response targeting the source port of a...

SUSE CVE-2023-30464

CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack...

CVE-2023-30464

CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack...

golang: net: malformed DNS message can cause infinite loop

A flaw was found in the net package of the Go stdlib. When a malformed DNS message is received as a response to a query, the Lookup functions within the net package can get stuck in an infinite loop. This issue can lead to resource exhaustion and denial of service DoS conditions...

CVE-2023-28457

An issue was discovered in Technitium through 11.0.3. It enables attackers to conduct a DNS cache poisoning attack and inject fake responses within 1 second, which is impactful...

CVE-2023-28451

An issue was discovered in Technitium 11.0.2. There is a vulnerability called BadDNS in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing DoS denial of service for normal resolution. The effects of an exploit would be widespread and highly impactful, becaus...

PT-2024-12161 · Unknown · Technitium

Name of the Vulnerable Software and Affected Versions: Technitium version 11.0.2 Description: An issue was discovered in the DNS resolving software, which triggers a resolver to ignore valid responses, thus causing a denial of service for normal resolution. The effects of an exploit would be...

PT-2024-12165 · Unknown · Technitium

Name of the Vulnerable Software and Affected Versions: Technitium versions through 11.0.3 Description: The issue enables attackers to conduct a DNS cache poisoning attack, allowing them to inject fake responses within 1 second. Recommendations: For versions through 11.0.3, update to a version tha...

Technitium DNS Server 安全漏洞

Technitium DNS Server is an open source authoritative and recursive DNS server from the Technitium team. It can be used to self-host DNS servers for privacy and security. A security vulnerability exists in Technitium DNS Server version 11.5.3, which stems from a DNSBomb operation that can lead to...

CoreDNS 安全漏洞

CoreDNS is a DNS server for the CoreDNS community. A security vulnerability exists in CoreDNS version 1.10.1 and earlier, which stems from an attack that enables an attacker to achieve DNS cache poisoning and inject false responses...

CVE-2023-30464

CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack...

External DNS requests from 'internal' networks could lead to data exfiltration

...

The vulnerability of the avahi_dns_packetAppendRecord() function in the Avahi service discovery system, related to the reachable assertion, allows a attacker to cause a service failure.

The vulnerability of the avahidnspacketAppendRecord function in the Avahi service discovery system is related to a reachable assertion. Exploiting this vulnerability allows an attacker to cause a service failure...

Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers and thus a return value may contain an unsafe injection (e.g. XSS) that does not conform to the RFC1035 format.

...

MindsDB 安全漏洞

MindsDB is an emerging low-code machine learning platform from MindsDB, Inc. A security vulnerability exists in versions prior to MindsDB v23.12.4.2, which stems from the fact that an attacker can bypass server-side request forgery protections throughout a website via DNS rebinding, and may also...

CVE-2024-8418

A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing...

DEBIAN-CVE-2024-8418

A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing...

UBUNTU-CVE-2024-8418

A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing...

CLSA-2024-1725443754 bind: Fix of CVE-2024-1737

CVE-2024-1737: add environment variable DNSRDATASETMAXRECORDS, DNSRBTDBMAXRTYPES to override hardcoded limits DDNSRDATASETMAXRECORDS and DDNSRBTDBMAXRTYPES - Fix man8 pages for dnssec utils...

golang: net: malformed DNS message can cause infinite loop

A flaw was found in the net package of the Go stdlib. When a malformed DNS message is received as a response to a query, the Lookup functions within the net package can get stuck in an infinite loop. This issue can lead to resource exhaustion and denial of service DoS conditions...