CVE-2022-30295: Medium severity uclibc vulnerability
Published May 6, 2022
·Updated
uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning. This is related to a reset of a value to 0x2.
Affected Software
2 affected components
uClibc uClibc<=0.9.33.2
Uclibc-ng Project Uclibc-ng<=1.0.40
Event History
May 6, 2022
CVE Published
via MITRE·04:43 AM
Data Sourced
via MITRE·04:43 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2022-30295?
CVE-2022-30295 is considered to be a high-severity vulnerability due to its potential for DNS cache poisoning.
2
How do I fix CVE-2022-30295?
To fix CVE-2022-30295, you should update uClibc-ng to version 1.0.41 or higher, or uClibc to version 0.9.33.3 or higher.
3
What software is affected by CVE-2022-30295?
CVE-2022-30295 affects uClibc-ng versions up to and including 1.0.40 and uClibc versions up to and including 0.9.33.2.
4
What kind of attack can exploit CVE-2022-30295?
CVE-2022-30295 can be exploited to conduct DNS cache poisoning attacks, which may lead to redirects or spoofing.
5
Is there any workaround for CVE-2022-30295?
Currently, the best mitigation for CVE-2022-30295 is to patch the affected versions of uClibc or uClibc-ng.