CVE-2023-28450: High severity thekelleys dnsmasq vulnerability
An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.
Other sources
Dnsmasq is vulnerable to a denial of service, caused by the use of default maximum EDNS.0 UDP packet size as 4096. By sending a specially crafted network traffic, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dnsmasqto a version that resolves this vulnerability.Fixed in 2.85-1+deb11u1Fixed in 2.90-4~deb12u1Fixed in 2.91-1 - Upgrade
Upgrade
dnsmasqto a version that resolves this vulnerability.Fixed in 2.90
Event History
Frequently Asked Questions
What is CVE-2023-28450?
CVE-2023-28450 is an issue discovered in Dnsmasq before version 2.90 where the default maximum EDNS.0 UDP packet size was set incorrectly.
What is the severity of CVE-2023-28450?
The severity of CVE-2023-28450 is high with a CVSS score of 7.5.
What software is affected by CVE-2023-28450?
Dnsmasq versions up to exclusive 2.90 are affected by CVE-2023-28450.
How can I fix CVE-2023-28450?
To fix CVE-2023-28450, upgrade to Dnsmasq version 2.90 or later.
Where can I find more information about CVE-2023-28450?
You can find more information about CVE-2023-28450 at the MITRE website and the Fedora Project mailing list.