PT-2024-12235 · Coredns · Coredns

Xiang Li · Published 2024-09-18 · Updated 2025-07-10 · CVE-2023-30464

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions CoreDNS versions 1.10.1 and earlier

Description The issue allows attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack, enabling them to manipulate DNS responses.

Recommendations For CoreDNS versions 1.10.1 and earlier, update to a version later than 1.10.1 to resolve the issue.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2023-30464

ECHO-B3DC-A2A9-53CC

GHSA-H92Q-FGPP-QHRQ

GO-2024-3134

OPENSUSE-SU-2024:0319-1

Affected Products

Coredns

References · 20

• https://osv.dev/vulnerability/openSUSE-SU-2024:0319-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30464 · Security Note
• https://osv.dev/vulnerability/GO-2024-3134 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h92q-fgpp-qhrq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-30464 · Vendor Advisory
• https://github.com/coredns/coredns/commit/604a902e2c7e0317aecaa3666124079c75a31573 · Note
• https://github.com/coredns/coredns · Note
• https://suse.com/security/cve/CVE-2024-0874 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/2JLUFKCHWHJJ2MQ6XRREF7D4OOWB23V2 · Note
• https://twitter.com/CVEnew/status/1836534067971404219 · Twitter Post
• https://github.com/advisories/GHSA-h92q-fgpp-qhrq · Note
• https://gist.github.com/idealeer/e41c7fb3b661d4262d0b6f21e12168ba · Note
• https://t.me/cvedetector/6022 · Telegram Post
• https://t.me/cvenotify/95164 · Telegram Post
• https://suse.com/security/cve/CVE-2023-28452 · Note