USN-6657-1: Dnsmasq vulnerabilities

Releases

• Ubuntu 23.10
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• dnsmasq - Small caching DNS proxy and DHCP/TFTP server

Details

Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Dnsmasq icorrectly handled validating DNSSEC messages. A remote
attacker could possibly use this issue to cause Dnsmasq to consume
resources, leading to a denial of service. (CVE-2023-50387)

It was discovered that Dnsmasq incorrectly handled preparing an NSEC3
closest encloser proof. A remote attacker could possibly use this issue to
cause Dnsmasq to consume resources, leading to a denial of service.
(CVE-2023-50868)

It was discovered that Dnsmasq incorrectly set the maximum EDNS.0 UDP
packet size as required by DNS Flag Day 2020. This issue only affected
Ubuntu 23.10. (CVE-2023-28450)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.10

• dnsmasq-base - 2.90-0ubuntu0.23.10.1

Ubuntu 22.04

• dnsmasq-base - 2.90-0ubuntu0.22.04.1

Ubuntu 20.04

• dnsmasq-base - 2.90-0ubuntu0.20.04.1

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to reboot your computer to
make all the necessary changes.

References

• CVE-2023-50387
• CVE-2023-50868
• CVE-2023-28450

Related notices

• USN-6633-1
• USN-6642-1
• USN-6665-1
• USN-6723-1
• USN-6657-2
• USN-6034-1