{"id":"CVE-2020-14312","aliases":["DEBIAN-CVE-2020-14312","EUVD-2020-6464","GHSA-xr95-5hhj-crp6","MGASA-2020-0310","OESA-2022-1821","SUSE-SU-2021:3530-1","UBUNTU-CVE-2020-14312","openSUSE-SU-2021:1426-1","openSUSE-SU-2021:3530-1","openSUSE-SU-2024:11653-1"],"status":"published","title":"A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior...","description":"A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01245,"percentile":0.69669,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2020-07-31T23:25:42Z","modified":"2026-10-26T12:01:27Z","fixes":[{"ecosystem":"Debian:12","package":"dnsmasq","fixed_in":["2.69-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dnsmasq","fixed_in":["2.69-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dnsmasq","fixed_in":["2.69-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"dnsmasq","fixed_in":["2.80-5.3.mga7"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"dnsmasq","fixed_in":["2.82-10.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"dnsmasq","fixed_in":["2.82-11.oe1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"dnsmasq","fixed_in":["2.86-3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.69-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.69-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.69-1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.80-5.3.mga7"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.82-10.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.82-11.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.86-7.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.86-7.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.86-7.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.86-7.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.86-7.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.86-7.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.86-7.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.86-7.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.86-7.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.86-7.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.66-4ubuntu1","2.67-1","2.68-1","2.68-1ubuntu0.1","2.68-1ubuntu0.2","2.68-1ubuntu0.2+esm1","2.68-1ubuntu0.2+esm2","2.68-1ubuntu0.2+esm3","2.68-1ubuntu0.2+esm5","2.68-1ubuntu0.2+esm6"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.86-lp152.7.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.86-7.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.86-3.1"}]}]}],"products":[{"vendor":"dnsmasq","product":"dnsmasq"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1851342","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14312","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xr95-5hhj-crp6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-14312","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0310.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26964","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1852373","tags":["report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1821","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213530-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1173646","tags":["report"]},{"url":"https://bugzilla.suse.com/1180914","tags":["report"]},{"url":"https://bugzilla.suse.com/1183709","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3448","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-14312","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14312","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Q5SXZU2UVUXVIVOLI6OT32WIQ6OJBE5E/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2DP73HQCB6UNPUB54KPOZEMBUQDVN6M6/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-14312","description":"A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.","status":"published","published":"2021-02-05T23:16:33Z","modified":"2024-08-04T12:39:36.268Z","cwes":["CWE-284"],"updated_at":"2026-11-02T14:35:46.476719Z"}],"euvd":[{"id":"EUVD-2020-6464","description":"A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.","status":"published","published":"2021-02-05T23:16:33Z","modified":"2024-08-04T12:39:36Z","updated_at":"2026-11-03T03:07:34.636169Z"}],"ghsa":[{"id":"GHSA-xr95-5hhj-crp6","title":"A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior...","description":"A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.","status":"published","published":"2022-05-24T17:41:13Z","modified":"2023-01-27T05:02:58Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:42:08.614878Z"}],"nvd":[{"id":"CVE-2020-14312","description":"A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.","status":"published","published":"2021-02-06T00:15:12.437Z","modified":"2026-06-17T02:54:31.037Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:06:34.188486Z"}],"osv":[{"id":"CVE-2020-14312","description":"A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.","status":"published","published":"2021-02-06T00:15:12.437Z","modified":"2026-04-16T04:35:59.104943922Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-14312","description":"A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.","status":"published","published":"2021-02-06T00:15:12.437Z","modified":"2026-10-26T12:01:27.952855412Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"OESA-2022-1821","title":"dnsmasq security update","description":"Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option local-service is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.(CVE-2020-14312)","status":"published","published":"2022-08-12T11:05:05Z","modified":"2026-08-18T01:16:23.688642825Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2020-14312","description":"A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.","status":"published","published":"2021-02-06T00:15:00Z","modified":"2026-05-26T20:00:12.974388309Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"MGASA-2020-0310","title":"Updated dnsmasq packages fix security vulnerability","description":"Updated dnsmasq package fix insecure default configuration potentially\nmaking it an open resolver (CVE-2020-14312).\n\nIn its default configuration, dnsmasq listen and answer query from any\naddress even outside of the local subnet. Thus, it may inadvertently\nbecome an open resolver which might be used in Distributed Denial of\nService attacks.\n\nThis update add the option --local-service at startup which limits\ndnsmasq to listen only to machines on the same local network.\n\nThis option only works if there aren't any of the following options\non cmdline or in dnsmasq.conf (without the double dash):\n--interface\n--except-interface\n--listen-address\n--auth-server\n","status":"published","published":"2020-07-31T23:25:42Z","modified":"2026-04-16T04:43:32.210513536Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2021:1426-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues:\n\nUpdate to version 2.86\n\n- CVE-2021-3448: fixed outgoing port used when --server is used with an interface name. (bsc#1183709)\n- CVE-2020-14312: Set --local-service by default (bsc#1173646).\n- Open inotify socket only when used (bsc#1180914).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2021-10-31T15:08:35Z","modified":"2026-02-04T04:24:17.584283Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3530-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues:\n\nUpdate to version 2.86\n\n- CVE-2021-3448: fixed outgoing port used when --server is used with an interface name. (bsc#1183709)\n- CVE-2020-14312: Set --local-service by default (bsc#1173646).\n- Open inotify socket only when used (bsc#1180914).\n","status":"published","published":"2021-10-27T07:24:50Z","modified":"2025-05-07T18:11:30.928101Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11653-1","title":"dnsmasq-2.86-3.1 on GA media","description":"These are all security issues fixed in the dnsmasq-2.86-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:11:30.989259Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2021:3530-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues:\n\nUpdate to version 2.86\n\n- CVE-2021-3448: fixed outgoing port used when --server is used with an interface name. (bsc#1183709)\n- CVE-2020-14312: Set --local-service by default (bsc#1173646).\n- Open inotify socket only when used (bsc#1180914).\n","status":"published","published":"2021-10-27T07:25:05Z","modified":"2026-02-04T02:17:50.802306Z","updated_at":"2026-11-02T15:53:49.605187Z"}]}}