PT-2022-8972 · Nabu Casa · Home Assistant Supervised+1

Mtdcro · Published 2022-03-07 · Updated 2022-03-14 · CVE-2020-36517

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nabu Casa Home Assistant Operating System version 2022.03 Home Assistant Supervised version 2022.03

Description An information leak in the affected systems allows a DNS operator to gain knowledge about internal network resources via the hardcoded DNS resolver configuration.

Recommendations For Nabu Casa Home Assistant Operating System version 2022.03, consider updating the DNS resolver configuration to prevent information leaks. For Home Assistant Supervised version 2022.03, update the DNS resolver configuration to mitigate the risk of internal network resource exposure.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2020-36517

Affected Products

Home Assistant Supervised

Nabu Casa Home Assistant Operating System

References · 19

• 🔥 https://github.com/home-assistant/plugin-dns/issues/51 · Exploit
• 🔥 https://github.com/home-assistant/plugin-dns/issues/6 · Exploit
• 🔥 https://github.com/home-assistant/plugin-dns/pull/55 · Exploit
• 🔥 https://github.com/home-assistant/plugin-dns/issues/53 · Exploit
• 🔥 https://github.com/home-assistant/plugin-dns/pull/56 · Exploit
• 🔥 https://github.com/home-assistant/plugin-dns/issues/50 · Exploit
• 🔥 https://github.com/home-assistant/plugin-dns/issues/54 · Exploit
• 🔥 https://github.com/home-assistant/plugin-dns/issues/64 · Exploit
• 🔥 https://github.com/home-assistant/plugin-dns/issues/70 · Exploit
• 🔥 https://github.com/home-assistant/plugin-dns/issues/20 · Exploit
• 🔥 https://community.home-assistant.io/t/ha-os-dns-setting-configuration-not-respected/356572 · Exploit
• https://github.com/home-assistant/plugin-dns/pull/58 · Patch
• https://github.com/home-assistant/plugin-dns/pull/59 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-36517 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36517 · Vendor Advisory