CVE-2023-28450

CWE-770 — Allocation without Limits11 documents8 sources
Severity
7.5HIGH
EPSS
0.0%
top 98.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Thekelleys Dnsmasq
Timeline
PublishedMar 15
Latest updateApr 24

Description

An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

â–¶NVDthekelleys/dnsmasq< 2.90
â–¶Debiandnsmasq< 2.85-1+deb11u1+3

🔴Vulnerability Details

4
OSV
dnsmasq vulnerabilities↗2024-02-26
â–¶
OSV
CVE-2023-28450: An issue was discovered in Dnsmasq before 2↗2023-03-15
â–¶
CVEList
CVE-2023-28450: An issue was discovered in Dnsmasq before 2↗2023-03-15
â–¶
GHSA
GHSA-vgrx-vhjf-p7wv: An issue was discovered in Dnsmasq before 2↗2023-03-15
â–¶

📋Vendor Advisories

6
Ubuntu
Dnsmasq vulnerabilities↗2024-04-24
â–¶
Ubuntu
Dnsmasq vulnerabilities↗2024-02-26
â–¶
Ubuntu
Dnsmasq vulnerability↗2023-04-20
â–¶
Red Hat
dnsmasq: default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232↗2023-03-15
â–¶
Microsoft
An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.↗2023-03-14
â–¶
CVE-2023-28450 (HIGH CVSS 7.5) | An issue was discovered in Dnsmasq | cvebase.io