oesa-2022-1821
Vulnerability from osv_openeuler
Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.
Security Fix(es):
A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option local-service is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.(CVE-2020-14312)
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"dnsmasq-help-2.82-10.oe1.aarch64.rpm",
"dnsmasq-2.82-10.oe1.aarch64.rpm",
"dnsmasq-debuginfo-2.82-10.oe1.aarch64.rpm",
"dnsmasq-debugsource-2.82-10.oe1.aarch64.rpm"
],
"src": [
"dnsmasq-2.82-10.oe1.src.rpm"
],
"x86_64": [
"dnsmasq-debugsource-2.82-10.oe1.x86_64.rpm",
"dnsmasq-help-2.82-10.oe1.x86_64.rpm",
"dnsmasq-debuginfo-2.82-10.oe1.x86_64.rpm",
"dnsmasq-2.82-10.oe1.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:20.03-LTS-SP1",
"name": "dnsmasq",
"purl": "pkg:rpm/openEuler/dnsmasq\u0026distro=openEuler-20.03-LTS-SP1"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.82-10.oe1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"ecosystem_specific": {
"aarch64": [
"dnsmasq-debugsource-2.82-11.oe1.aarch64.rpm",
"dnsmasq-2.82-11.oe1.aarch64.rpm",
"dnsmasq-help-2.82-11.oe1.aarch64.rpm",
"dnsmasq-debuginfo-2.82-11.oe1.aarch64.rpm"
],
"src": [
"dnsmasq-2.82-11.oe1.src.rpm"
],
"x86_64": [
"dnsmasq-debugsource-2.82-11.oe1.x86_64.rpm",
"dnsmasq-2.82-11.oe1.x86_64.rpm",
"dnsmasq-debuginfo-2.82-11.oe1.x86_64.rpm",
"dnsmasq-help-2.82-11.oe1.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:20.03-LTS-SP3",
"name": "dnsmasq",
"purl": "pkg:rpm/openEuler/dnsmasq\u0026distro=openEuler-20.03-LTS-SP3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.82-11.oe1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "Medium"
},
"details": "Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option local-service is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.(CVE-2020-14312)",
"id": "OESA-2022-1821",
"modified": "2026-08-06T11:05:05Z",
"published": "2022-08-12T11:05:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1821"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14312"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "dnsmasq security update",
"upstream": [
"CVE-2020-14312"
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.