CVE-2020-25686Not scoredCWE-358

CVE-2020-25686: Thekelleys dnsmasq vulnerability

Thekelleys · dnsmasq

Fixed in 2.83 · Affected: Thekelleys dnsmasq before 2.83 · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

5.5%probability of exploitation in the next 30 days

92nd percentile

050100

Higher than 92% of scored CVEs

Not scored yet. The CVE record carries no CVSS score.

DescriptionCVE.org

A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the "Birthday Attacks" section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

dnsmasqdnsmasq 2.83

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Improperly Implemented Security Check for Standard · Cryptography
Vendor: Thekelleys
Published: January 2021
Band: Possible (1 to 10%), January 2021

CoverageNo articles yet

No CyberSIXT article names CVE-2020-25686 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.