REDHAT-BUG-2445242: High severity CoreDNS CoreDNS vulnerability
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDNS's loop detection plugin that allows an attacker to crash the DNS server by sending specially crafted DNS queries. The vulnerability stems from the use of a predictable pseudo-random number generator (PRNG) for generating a secret query name, combined with a fatal error handler that terminates the entire process. This issue has been patched in version 1.14.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CoreDNSto a version that resolves this vulnerability.Fixed in 1.14.2
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2445242?
The severity of REDHAT-BUG-2445242 is categorized as high with a score of 7.
What vulnerability does REDHAT-BUG-2445242 describe?
REDHAT-BUG-2445242 describes a denial of service vulnerability in CoreDNS's loop detection plugin.
How can I exploit REDHAT-BUG-2445242?
An attacker can exploit REDHAT-BUG-2445242 by sending specially crafted DNS queries to crash the DNS server.
How do I fix REDHAT-BUG-2445242?
To fix REDHAT-BUG-2445242, upgrade CoreDNS to version 1.14.2 or later.
Which software is affected by REDHAT-BUG-2445242?
The affected software is CoreDNS prior to version 1.14.2.