Vulnerability · Published Feb 5, 2021 · Assigned by redhat

CVE-2020-14312

Medium 5.9

In plain English

A medium-severity improper access control in dnsmasq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.9Medium

Exploit odds (30 days)1.2%top 30.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	dnsmasq	2.69-1	DEBIAN-CVE-2020-14312
Debian:13	dnsmasq	2.69-1	DEBIAN-CVE-2020-14312
Debian:14	dnsmasq	2.69-1	DEBIAN-CVE-2020-14312

Affected products (as reported)

Vendor	Product	Versions
n/a	dnsmasq	Fedora version prior to 31all RHEL versions

Weakness: CWE-284

References

https://bugzilla.redhat.com/show_bug.cgi?id=1851342 x_refsource_MISC