CVE-2023-28452

An issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing denial of service for normal resolution. In an exploit, the attacker could just forge a response targeting the source port of a vulnerable resolver without the need to guess the correct TXID.

An issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing denial of service for normal resolution. In an exploit, the attacker could just forge a response targeting the source port of a vulnerable resolver without the need to guess the correct TXID.

An issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing denial of service for normal resolution. In an exploit, the attacker could just forge a response targeting the source port of a vulnerable resolver without the need to guess the correct TXID.

An issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing denial of service for normal resolution. In an exploit, the attacker could just forge a response targeting the source port of a vulnerable resolver without the need to guess the correct TXID.

An issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing denial of service for normal resolution. In an exploit, the attacker could just forge a response targeting the source port of a vulnerable resolver without the need to guess the correct TXID.

An issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing denial of service for normal resolution. In an exploit, the attacker could just forge a response targeting the source port of a vulnerable resolver without the need to guess the correct TXID.

CoreDNS is a fast and flexible DNS server. The key word here is flexible: with CoreDNS you are able to do what you want with your DNS data by utilizing plugins.

Security Fix(es):

An issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing denial of service for normal resolution. In an exploit, the attacker could just forge a response targeting the source port of a vulnerable resolver without the need to guess the correct TXID.(CVE-2023-28452)

CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.(CVE-2023-30464)

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-HTTPS (DoH) GET path accepts oversized dns= query parameter values and performs URL query parsing, base64 decoding, and DNS message unpacking before rejecting the request. Unlike the POST path, which applies a bounded read via http.MaxBytesReader limited to 65536 bytes, the GET path has no equivalent size validation before expensive processing. A remote, unauthenticated attacker can repeatedly send oversized DoH GET requests to force high CPU usage, large transient memory allocations, and elevated garbage-collection pressure, leading to denial of service. This issue has been fixed in version 1.14.3.(CVE-2026-32936)

CoreDNS vulnerable to TuDoor Attacks in github.com/coredns/coredns

This update for coredns fixes the following issues:

Update to version 1.11.3:

• optimize the performance for high qps (#6767)
• bump deps
• Fix zone parser error handling (#6680)
• Add alternate option to forward plugin (#6681)
• fix: plugin/file: return error when parsing the file fails (#6699)
• [fix:documentation] Clarify autopath README (#6750)
• Fix outdated test (#6747)
• Bump go version from 1.21.8 to 1.21.11 (#6755)
• Generate zplugin.go correctly with third-party plugins (#6692)
• dnstap: uses pointer receiver for small response writer (#6644)
• chore: fix function name in comment (#6608)
• [plugin/forward] Strip local zone from IPV6 nameservers (#6635)

• fixes CVE-2023-30464
• fixes CVE-2023-28452

Update to upstream head (git commit #5a52707):

• bump deps to address security issue CVE-2024-22189
• Return RcodeServerFailure when DNS64 has no next plugin (#6590)
• add plusserver to adopters (#6565)
• Change the log flags to be a variable that can be set prior to calling Run (#6546)
• Enable Prometheus native histograms (#6524)
• forward: respect context (#6483)
• add client labels to k8s plugin metadata (#6475)
• fix broken link in webpage (#6488)
• Repo controlled Go version (#6526)
• removed the mutex locks with atomic bool (#6525)

Update to version 1.11.2:

• rewrite: fix multi request concurrency issue in cname rewrite (#6407)
• plugin/tls: respect the path specified by root plugin (#6138)
• plugin/auto: warn when auto is unable to read elements of the directory tree (#6333)
• fix: make the codeowners link relative (#6397)
• plugin/etcd: the etcd client adds the DialKeepAliveTime parameter (#6351)
• plugin/cache: key cache on Checking Disabled (CD) bit (#6354)
• Use the correct root domain name in the proxy plugin's TestHealthX tests (#6395)
• Add PITS Global Data Recovery Services as an adopter (#6304)
• Handle UDP responses that overflow with TC bit with test case (#6277)
• plugin/rewrite: add rcode as a rewrite option (#6204)

• CVE-2024-0874: coredns: CD bit response is cached and served later

• Update to version 1.11.1:

  • Revert “plugin/forward: Continue waiting after receiving malformed responses
  • plugin/dnstap: add support for “extra” field in payload
  • plugin/cache: fix keepttl parsing

• Update to version 1.11.0:

  • Adds support for accepting DNS connections over QUIC (doq).
  • Adds CNAME target rewrites to the rewrite plugin.
  • Plus many bug fixes, and some security improvements.
  • This release introduces the following backward incompatible changes:
  • In the kubernetes plugin, we have dropped support for watching Endpoint and Endpointslice v1beta, since all supported K8s versions now use Endpointslice.
  • The bufsize plugin changed its default size limit value to 1232
  • Some changes to forward plugin metrics.

• Update to version 1.10.1:

  • Corrected architecture labels in multi-arch image manifest
  • A new plugin timeouts that allows configuration of server listener timeout durations
  • acl can drop queries as an action
  • template supports creating responses with extended DNS errors
  • New weighted policy in loadbalance
  • Option to serve original record TTLs from cache

• Update to version 1.10.0:

  • core: add log listeners for k8s_event plugin (#5451)
  • core: log DoH HTTP server error logs in CoreDNS format (#5457)
  • core: warn when domain names are not in RFC1035 preferred syntax (#5414)
  • plugin/acl: add support for extended DNS errors (#5532)
  • plugin/bufsize: do not expand query UDP buffer size if already set to a smaller value (#5602)
  • plugin/cache: add cache disable option (#5540)
  • plugin/cache: add metadata for wildcard record responses (#5308)
  • plugin/cache: add option to adjust SERVFAIL response cache TTL (#5320)
  • plugin/cache: correct responses to Authenticated Data requests (#5191)
  • plugin/dnstap: add identity and version support for the dnstap plugin (#5555) *…