PT-2022-11600 · Unknown · Kapetan Dns

Published 2022-12-18 · Updated 2022-12-22 · CVE-2021-4248

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions kapetan dns versions up to 6.1.0

Description A vulnerability was found in the DNS/Protocol/Request.cs file, leading to insufficient entropy in prng. The attack may be launched remotely. The issue is rated as problematic.

Recommendations For kapetan dns versions up to 6.1.0, upgrade to version 7.0.0 to address the issue.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2021-4248

GHSA-G3WC-XV93-445Q

Affected Products

Kapetan Dns

References · 10

• https://github.com/kapetan/dns/pull/88 · Patch
• https://github.com/kapetan/dns/commit/cf7105aa2aae90d6656088fe5a8ee1d5730773b6 · Patch
• https://osv.dev/vulnerability/GHSA-g3wc-xv93-445q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4248 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4248 · Vendor Advisory
• https://github.com/kapetan/dns/releases/tag/v7.0.0 · Note
• https://github.com/kapetan/dns · Note
• https://vuldb.com/?id.216188 · Note
• https://t.me/cibsecurity/54818 · Telegram Post
• https://t.me/cvenotify/40429 · Telegram Post