GHSA-m9w6-wp3h-vq8g CVE-2024-0874 GO-2024-2785
CoreDNS may return invalid cache entries
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.76%
- Chance of exploitation in the next 30 days. Higher than 55.30% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-524 Use of Cache Containing Sensitive Information
- Fix
1.11.2- Upgrade github.com/coredns/coredns to this version or later
Description
A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/coredns/coredns | < 1.11.2 |
1.11.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/coredns/coredns Go → 1.11.2
- go
go get github.com/coredns/coredns@v1.11.2 && go mod tidy
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Weakness
CWE-524: Use of Cache Containing Sensitive Information
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
How to prevent it
- Architecture and Design: Protect information stored in cache.
- Architecture and Design: Do not store unnecessarily sensitive information in the cache.
- Architecture and Design: Consider using encryption in the cache.
References
Advisories
Packages
Other links
- github.com/coredns/coredns/issues/6186
- github.com/coredns/coredns/pull/6354
- github.com/coredns/coredns/commit/997c7f953962d47c242273f0e41398fdfb5b0151
- access.redhat.com/errata/RHSA-2024:0041
- access.redhat.com/errata/RHSA-2024:4850
- access.redhat.com/errata/RHSA-2024:6009
- access.redhat.com/errata/RHSA-2024:6406
- access.redhat.com/security/cve/CVE-2024-0874
- bugzilla.redhat.com/show_bug.cgi
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-9gm5-9rfh-m6vx CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP | High | Also affects github.com/coredns/coredns |
| GHSA-mrg3-qvqr-jw29 CoreDNS: Unauthenticated memory exhaustion in custom transports | High | Also affects github.com/coredns/coredns |
| GHSA-74w3-63xv-x9mv CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin | Low | Also affects github.com/coredns/coredns |
| GHSA-vp29-5652-4fw9 CoreDNS has TSIG authentication bypass on gRPC and QUIC transports | Critical | Also affects github.com/coredns/coredns |
| GHSA-qhmp-q7xh-99rh CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC | High | Also affects github.com/coredns/coredns |
| GHSA-h8mm-c463-wjq3 CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass) | High | Also affects github.com/coredns/coredns |
| GHSA-63cw-r7xf-jmwr CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification | High | Also affects github.com/coredns/coredns |
| GHSA-2wpx-qpw2-g5h5 CoreDNS' DoQ worker pool does not bound stream backlog | High | Also affects github.com/coredns/coredns |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor