Every CVE Search/ Get API key

CVE-2020-14312

A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior...

5.9 MediumFix available

A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option local-service is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.24%Up 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.9

A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option local-service is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.

Record
CVE-2020-14312
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-284
Updated
2026-11-02
CVE List No score

A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option local-service is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.

Record
CVE-2020-14312
Weakness
CWE-284
Updated
2026-11-02
EUVDEUVD-2020-6464 No score

A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option local-service is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.

Record
EUVD-2020-6464
Updated
2026-11-03
GitHub AdvisoriesGHSA-xr95-5hhj-crp6 5.9

A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior...

A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option local-service is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.

Record
GHSA-xr95-5hhj-crp6
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-284
Updated
2026-11-02
OSV 5.9

A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option local-service is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.

Record
CVE-2020-14312
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-14312 5.9

A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option local-service is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.

Record
DEBIAN-CVE-2020-14312
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVOESA-2022-1821 5.9

dnsmasq security update

Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.

Security Fix(es):

A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option local-service is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.(CVE-2020-14312)

Record
OESA-2022-1821
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-14312 5.9

A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option local-service is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.

Record
UBUNTU-CVE-2020-14312
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2020-0310 No score

Updated dnsmasq packages fix security vulnerability

Updated dnsmasq package fix insecure default configuration potentially making it an open resolver (CVE-2020-14312).

In its default configuration, dnsmasq listen and answer query from any address even outside of the local subnet. Thus, it may inadvertently become an open resolver which might be used in Distributed Denial of Service attacks.

This update add the option --local-service at startup which limits dnsmasq to listen only to machines on the same local network.

This option only works if there aren't any of the following options on cmdline or in dnsmasq.conf (without the double dash): --interface --except-interface --listen-address --auth-server

Record
MGASA-2020-0310
Updated
2026-11-02
OSVopenSUSE-SU-2021:1426-1 No score

Security update for dnsmasq

This update for dnsmasq fixes the following issues:

Update to version 2.86

  • CVE-2021-3448: fixed outgoing port used when --server is used with an interface name. (bsc#1183709)
  • CVE-2020-14312: Set --local-service by default (bsc#1173646).
  • Open inotify socket only when used (bsc#1180914).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

Record
openSUSE-SU-2021:1426-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:3530-1 No score

Security update for dnsmasq

This update for dnsmasq fixes the following issues:

Update to version 2.86

  • CVE-2021-3448: fixed outgoing port used when --server is used with an interface name. (bsc#1183709)
  • CVE-2020-14312: Set --local-service by default (bsc#1173646).
  • Open inotify socket only when used (bsc#1180914).
Record
openSUSE-SU-2021:3530-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11653-1 No score

dnsmasq-2.86-3.1 on GA media

These are all security issues fixed in the dnsmasq-2.86-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11653-1
Updated
2026-11-02
OSVSUSE-SU-2021:3530-1 No score

Security update for dnsmasq

This update for dnsmasq fixes the following issues:

Update to version 2.86

  • CVE-2021-3448: fixed outgoing port used when --server is used with an interface name. (bsc#1183709)
  • CVE-2020-14312: Set --local-service by default (bsc#1173646).
  • Open inotify socket only when used (bsc#1180914).
Record
SUSE-SU-2021:3530-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dnsmasq
Debian:12
 before 2.69-1
2.69-1
dnsmasq
Debian:13
 before 2.69-1
2.69-1
dnsmasq
Debian:14
 before 2.69-1
2.69-1
dnsmasq
Mageia:7
 before 2.80-5.3.mga7
2.80-5.3.mga7
dnsmasq
openEuler:20.03-LTS-SP1
 before 2.82-10.oe1
2.82-10.oe1
dnsmasq
openEuler:20.03-LTS-SP3
 before 2.82-11.oe1
2.82-11.oe1
dnsmasq
SUSE:Linux Enterprise Module for Basesystem 15 SP2
From an advisory covering 2 CVEs
 before 2.86-7.14.1
2.86-7.14.1
dnsmasq
SUSE:Linux Enterprise Module for Basesystem 15 SP3
From an advisory covering 2 CVEs
 before 2.86-7.14.1
2.86-7.14.1
dnsmasq
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 2 CVEs
 before 2.86-7.14.1
2.86-7.14.1
dnsmasq
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 2 CVEs
 before 2.86-7.14.1
2.86-7.14.1
Show 10 moreShow less
Affected packages
PackageAffectedFixed
dnsmasq
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 2 CVEs
 before 2.86-7.14.1
2.86-7.14.1
dnsmasq
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 2 CVEs
 before 2.86-7.14.1
2.86-7.14.1
dnsmasq
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 2 CVEs
 before 2.86-7.14.1
2.86-7.14.1
dnsmasq
SUSE:Linux Enterprise Micro 5.0
From an advisory covering 2 CVEs
 before 2.86-7.14.1
2.86-7.14.1
dnsmasq
SUSE:Linux Enterprise Micro 5.1
From an advisory covering 2 CVEs
 before 2.86-7.14.1
2.86-7.14.1
dnsmasq
SUSE:Enterprise Storage 6
From an advisory covering 2 CVEs
 before 2.86-7.14.1
2.86-7.14.1
dnsmasq
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.66-4ubuntu12.67-12.68-12.68-1ubuntu0.12.68-1ubuntu0.2
Show 5 moreShow less
2.68-1ubuntu0.2+esm12.68-1ubuntu0.2+esm22.68-1ubuntu0.2+esm32.68-1ubuntu0.2+esm52.68-1ubuntu0.2+esm6
 None known
dnsmasq
openSUSE:Leap 15.2
From an advisory covering 2 CVEs
 before 2.86-lp152.7.6.1
2.86-lp152.7.6.1
dnsmasq
openSUSE:Leap 15.3
From an advisory covering 2 CVEs
 before 2.86-7.14.1
2.86-7.14.1
dnsmasq
openSUSE:Tumbleweed
 before 2.86-3.1
2.86-3.1

History

History
RecordedChangedSources
affected, facts
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-14312 is a medium vulnerability (CVSS 5.9) in Dnsmasq, published July 31, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.24%, the 69th percentile. Fixed in dnsmasq 2.69-1.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open