Improper access control in dnsmasq
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Will not fix Red Hat: no fix planned
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-284.
Summary
A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | dnsmasq | Fedora version prior to 31; all RHEL versions | — | No fix listed | CNA |
- dnsmasq Vendor— Affected Fedora version prior to 31; all RHEL versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:* | before 31 | Vulnerable | Fedoraproject |
- cpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:* Versions before 31 Vulnerable ·Fedoraproject
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
Not affected: 1 product
- Red Hat OpenStack Platform 13 (Queens)
Timeline
- 2026-10-02 Threatist record created from CVE-2020-14312
- 2026-10-03 Alias added: GHSA-xr95-5hhj-crp6
References
More Fedoraproject Fedora vulnerabilities
- TI-2024-04898 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
- TI-2024-04600 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
- TI-2024-04346 Use after free in Google Chrome KEVCVSS 3.1CRITICAL 9.6
- TI-2024-04260 Argument Injection in PHP-CGI KEVCVSS 3.1CRITICAL 9.8
- TI-2023-05824 Integer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6
- TI-2023-02004 Integer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6
Sources
- CVE-2020-14312 · CVE Program
- CVE-2020-14312 · NVD
- FIRST EPSS
- GHSA-xr95-5hhj-crp6 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-14312 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences