PT-2023-2475 · Dnsmasq+9 · Dnsmasq+9

Published 2023-03-08 · Updated 2025-02-03 · CVE-2023-28450

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Dnsmasq versions prior to 2.90

Description An issue was discovered in Dnsmasq where the default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 due to DNS Flag Day 2020. This issue may allow a remote attacker to cause a denial of service.

Recommendations For versions prior to 2.90, update to version 2.90 or later to resolve the issue. As a temporary workaround, consider setting the maximum EDNS.0 UDP packet size to 1232 to minimize the risk of exploitation.

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

ALSA-2023:6524

ALSA-2023:7046

ALT-PU-2023-1523

ALT-PU-2023-1548

ALT-PU-2023-1570

ALT-PU-2023-8012

ALT-PU-2024-3156

AZL-25660

BDU:2023-02265

CESA-2023_7046

CVE-2023-28450

DLA-3974-1

MGASA-2023-0153

OPENSUSE-SU-2024:12887-1

OPENSUSE-SU-2025_0071-1

RHSA-2023:6524

RHSA-2023:7046

RHSA-2023_6524

RHSA-2023_7046

RHSA-2024:1544

RHSA-2024:1545

RHSA-2024:4052

ROSA-SA-2023-2283

SUSE-SU-2023:1930-1

SUSE-SU-2023:2123-1

SUSE-SU-2023_1930-1

SUSE-SU-2023_2123-1

SUSE-SU-2025:0071-1

SUSE-SU-2025:20118-1

USN-6034-1

USN-6657-1

USN-6657-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Dnsmasq

Linuxmint

Red Hat

Red Os

Suse

Ubuntu

References · 76

• https://osv.dev/vulnerability/SUSE-SU-2023:2123-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28450 · Security Note
• https://ubuntu.com/security/CVE-2023-28450 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-6524.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:0071-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0153.html · Security Note
• https://cve.org/CVERecord?id=CVE-2023-28450 · Security Note
• https://ubuntu.com/security/CVE-2023-50387 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-25660 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0319SE17 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28450 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3974-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6UQ6LKDTLSSD64TBIZ3XEKBM2SWC63VV · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28450 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6UQ6LKDTLSSD64TBIZ3XEKBM2SWC63VV · Vendor Advisory