GHSA-ch7v-37xg-75ph CVE-2022-2835
coreDNS vulnerable to Improper Restriction of Communication Channel to Intended Endpoints
- Severity
- 4.4 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.18%
- Chance of exploitation in the next 30 days. Higher than 7.05% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-923 Improper Restriction of Communication Channel to Intended Endpoints
- Fix
- None yet
- No fixed version published
Description
A flaw was found in coreDNS. This flaw allows a malicious user to reroute internal calls to some internal services that were accessed by the FQDN in a format of <service>.<namespace>.svc.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/coredns/coredns | <= 1.9.3 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 4.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Weakness
CWE-923: Improper Restriction of Communication Channel to Intended Endpoints
The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-9gm5-9rfh-m6vx CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP | High | Also affects github.com/coredns/coredns |
| GHSA-mrg3-qvqr-jw29 CoreDNS: Unauthenticated memory exhaustion in custom transports | High | Also affects github.com/coredns/coredns |
| GHSA-74w3-63xv-x9mv CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin | Low | Also affects github.com/coredns/coredns |
| GHSA-vp29-5652-4fw9 CoreDNS has TSIG authentication bypass on gRPC and QUIC transports | Critical | Also affects github.com/coredns/coredns |
| GHSA-qhmp-q7xh-99rh CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC | High | Also affects github.com/coredns/coredns |
| GHSA-h8mm-c463-wjq3 CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass) | High | Also affects github.com/coredns/coredns |
| GHSA-63cw-r7xf-jmwr CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification | High | Also affects github.com/coredns/coredns |
| GHSA-2wpx-qpw2-g5h5 CoreDNS' DoQ worker pool does not bound stream backlog | High | Also affects github.com/coredns/coredns |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor