CVE-2023-28450

An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.

An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.

An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.

The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.

Security Fix(es):

• dnsmasq: default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 (CVE-2023-28450)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.

Security Fix(es):

• dnsmasq: default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 (CVE-2023-28450)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• change EDNS.0 UDP packet size from 4096 to 1232
• CVE-2023-28450

• CVE-2023-28450: Set the default maximum DNS UDP packet size to 1232

• Build for rhel7els, oraclelinux7els and cloudlinux7els: they get the existing fixes for CVE-2022-0934, CVE-2023-28450, CVE-2026-4890, CVE-2026-4891 and CVE-2026-4892
• Bump release to sort above Oracle Linux 7 dnsmasq-2.76-17.0.3.el7_9.3

• Build for rhel7els, oraclelinux7els and cloudlinux7els: they get the existing fixes for CVE-2022-0934, CVE-2023-28450, CVE-2026-4890, CVE-2026-4891 and CVE-2026-4892
• Bump release to sort above Oracle Linux 7 dnsmasq-2.76-17.0.3.el7_9.3

A flaw was found in Dnsmasq. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. (CVE-2023-28450)

These are all security issues fixed in the dnsmasq-2.89-3.1 package on the GA media of openSUSE Tumbleweed.

This update for dnsmasq fixes the following issues:

• CVE-2023-28450: Fixed default maximum size for EDNS.0 UDP packets (bsc#1209358).

This update for dnsmasq fixes the following issues:

• CVE-2023-28450: Fixed default maximum size for EDNS.0 UDP packets (bsc#1209358).

This update for dnsmasq fixes the following issues:

• Version update to 2.90:
• CVE-2023-50387: Fixed a Denial Of Service while trying to validate specially crafted DNSSEC responses. (bsc#1219823)
• CVE-2023-50868: Fixed a Denial Of Service while trying to validate specially crafted DNSSEC responses. (bsc#1219826)
• CVE-2023-28450: Default maximum EDNS.0 UDP packet size should be 1232. (bsc#1209358)

This update for dnsmasq fixes the following issues:

• Update to 2.90:

  • CVE-2023-50387, CVE-2023-50868: Fixed a Denial Of Service while trying to validate specially crafted DNSSEC responses (bsc#1219823, bsc#1219826).
  • Fix reversion in --rev-server introduced in 2.88 which caused breakage if the prefix length is not exactly divisible by 8 (IPv4) or 4 (IPv6).
  • Fix possible SEGV when there server(s) for a particular domain are configured, but no server which is not qualified for a particular domain.
  • Set the default maximum DNS UDP packet sice to 1232.
  • Add --no-dhcpv4-interface and --no-dhcpv6-interface for better control over which interfaces are providing DHCP service.
  • Fix issue with stale caching
  • Add configurable caching for arbitrary RR-types.
  • Add --filter-rr option, to filter arbitrary RR-types.

• SLP got dropped, remove config (bsc#1214884)

It was discovered that Dnsmasq was sending large DNS messages over UDP, possibly causing transmission failures due to IP fragmentation. This update lowers the default maximum size of DNS messages to improve transmission reliability over UDP.

Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered that Dnsmasq icorrectly handled validating DNSSEC messages. A remote attacker could possibly use this issue to cause Dnsmasq to consume resources, leading to a denial of service. (CVE-2023-50387)

It was discovered that Dnsmasq incorrectly handled preparing an NSEC3 closest encloser proof. A remote attacker could possibly use this issue to cause Dnsmasq to consume resources, leading to a denial of service. (CVE-2023-50868)

It was discovered that Dnsmasq incorrectly set the maximum EDNS.0 UDP packet size as required by DNS Flag Day 2020. This issue only affected Ubuntu 23.10. (CVE-2023-28450)

USN-6657-1 fixed several vulnerabilities in Dnsmasq. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered that Dnsmasq icorrectly handled validating DNSSEC messages. A remote attacker could possibly use this issue to cause Dnsmasq to consume resources, leading to a denial of service. (CVE-2023-50387)

It was discovered that Dnsmasq incorrectly handled preparing an NSEC3 closest encloser proof. A remote attacker could possibly use this issue to cause Dnsmasq to consume resources, leading to a denial of service. (CVE-2023-50868)

It was discovered that Dnsmasq incorrectly set the maximum EDNS.0 UDP packet size as required by DNS Flag Day 2020. This issue only affected Ubuntu 23.10. (CVE-2023-28450)