A flaw was found in dnsmasq before version 2.83.
Priority LOW 22CWE-326Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 33 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-326.
Summary
A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.
Why it matters now
EPSS 0.02227 82nd percentileScored 2026-11-07
Fix Partial Red Hat: 11 advisoriesRed Hat: 33 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | dnsmasq | dnsmasq 2.83 | — | No fix listed | CNA |
- dnsmasq Vendor— Affected dnsmasq 2.83 Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:* | before 2.83 | Vulnerable | Thekelleys |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:* | 4.21 to before 4.21.14m; 4.22 to before 4.22.9m; 4.23 to before 4.23.7m; 4.24 to before 4.24.5m; 4.25 to before 4.25.2f | Vulnerable | Arista |
- cpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:* Versions before 2.83 Vulnerable ·Thekelleys
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:* Versions 4.21 to before 4.21.14m; 4.22 to before 4.22.9m; 4.23 to before 4.23.7m; 4.24 to before 4.24.5m; 4.25 to before 4.25.2f Vulnerable ·Arista
Remediation
Red Hat 11 advisories
- RHSA-2021:0401 Released 2021-02-03 · Red Hat rating ImportantRed Hat Virtualization Host security bug fix and enhancement update [ovirt-4.4.4]
- Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host-4.4.4-20210201.0.el8_3, redhat-virtualization-host-image-update-4.4.4-20210201.0.el8_3
- RHSA-2021:0395 Released 2021-02-03 · Red Hat rating ImportantRHV-H security, bug fix, enhancement update (redhat-virtualization-host) 4.3.13
- RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-virtualization-host-4.3.13-20210127.0.el7_9, redhat-virtualization-host-image-update-4.3.13-20210127.0.el7_9
- Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host-4.3.13-20210127.0.el7_9, redhat-virtualization-host-image-update-4.3.13-20210127.0.el7_9
- RHSA-2021:0245 Released 2021-01-25 · Red Hat rating Moderatednsmasq security update
- Red Hat Enterprise Linux Server AUS (v. 7.3) dnsmasq-2.66-21.el7_3.3
- Red Hat Enterprise Linux Server Optional AUS (v. 7.3) dnsmasq-utils-2.66-21.el7_3.3
Show 8 more Red Hat advisories
- RHSA-2021:0240 Released 2021-01-25 · Red Hat rating Moderatednsmasq security update
- Red Hat Enterprise Linux Server AUS (v. 7.2) dnsmasq-2.66-14.el7_2.3
- Red Hat Enterprise Linux Server Optional AUS (v. 7.2) dnsmasq-utils-2.66-14.el7_2.3
- RHSA-2021:0153 Released 2021-01-19 · Red Hat rating Moderatednsmasq security update
- Red Hat Enterprise Linux Client (v. 7) dnsmasq-2.76-16.el7_9.1
- Red Hat Enterprise Linux Client Optional (v. 7) dnsmasq-utils-2.76-16.el7_9.1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) dnsmasq-utils-2.76-16.el7_9.1
- Red Hat Enterprise Linux Server (v. 7) dnsmasq-2.76-16.el7_9.1
- Red Hat Enterprise Linux Server Optional (v. 7) dnsmasq-utils-2.76-16.el7_9.1
- Red Hat Enterprise Linux Workstation (v. 7) dnsmasq-2.76-16.el7_9.1
- Red Hat Enterprise Linux Workstation Optional (v. 7) dnsmasq-utils-2.76-16.el7_9.1
- RHSA-2021:0155 Released 2021-01-19 · Red Hat rating Moderatednsmasq security update
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) dnsmasq-2.76-7.el7_6.2
- Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) dnsmasq-utils-2.76-7.el7_6.2
- Red Hat Enterprise Linux Server EUS (v. 7.6) dnsmasq-2.76-7.el7_6.2
- Red Hat Enterprise Linux Server Optional EUS (v. 7.6) dnsmasq-utils-2.76-7.el7_6.2
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) dnsmasq-2.76-7.el7_6.2
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) dnsmasq-utils-2.76-7.el7_6.2
- RHSA-2021:0150 Released 2021-01-19 · Red Hat rating Importantdnsmasq security update
- Red Hat Enterprise Linux AppStream (v. 8) dnsmasq-2.79-13.el8_3.1, dnsmasq-utils-2.79-13.el8_3.1
- RHSA-2021:0154 Released 2021-01-19 · Red Hat rating Moderatednsmasq security update
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) dnsmasq-2.76-10.el7_7.2
- Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) dnsmasq-utils-2.76-10.el7_7.2
- Red Hat Enterprise Linux Server EUS (v. 7.7) dnsmasq-2.76-10.el7_7.2
- Red Hat Enterprise Linux Server Optional EUS (v. 7.7) dnsmasq-utils-2.76-10.el7_7.2
- RHSA-2021:0156 Released 2021-01-19 · Red Hat rating Moderatednsmasq security update
- Red Hat Enterprise Linux Server AUS (v. 7.4) dnsmasq-2.76-2.el7_4.3
- Red Hat Enterprise Linux Server E4S (v. 7.4) dnsmasq-2.76-2.el7_4.3
- Red Hat Enterprise Linux Server Optional AUS (v. 7.4) dnsmasq-utils-2.76-2.el7_4.3
- Red Hat Enterprise Linux Server Optional E4S (v. 7.4) dnsmasq-utils-2.76-2.el7_4.3
- Red Hat Enterprise Linux Server Optional TUS (v. 7.4) dnsmasq-utils-2.76-2.el7_4.3
- Red Hat Enterprise Linux Server TUS (v. 7.4) dnsmasq-2.76-2.el7_4.3
- RHSA-2021:0151 Released 2021-01-19 · Red Hat rating Importantdnsmasq security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.2) dnsmasq-2.79-11.el8_2.2, dnsmasq-utils-2.79-11.el8_2.2
- RHSA-2021:0152 Released 2021-01-19 · Red Hat rating Importantdnsmasq security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.1) dnsmasq-2.79-6.el8_1.1, dnsmasq-utils-2.79-6.el8_1.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
dnsmasq — FEDORA-2021-2e4c3d5a9d
7 records Highest priority Priority HIGH 4 HIGH, 3 LOW
Other records, highest priority first
- TI-2020-15697 Heap-based buffer overflow in dnsmasqPriority HIGH 76
- TI-2020-15698 Heap-based buffer overflow in dnsmasqPriority HIGH 74
- TI-2020-15703 Heap-based buffer overflow in dnsmasqPriority HIGH 69
- Advisory ·
dnsmasq — FEDORA-2021-84440e87ba
7 records Highest priority Priority HIGH 4 HIGH, 3 LOW
Other records, highest priority first
- TI-2020-15697 Heap-based buffer overflow in dnsmasqPriority HIGH 76
- TI-2020-15698 Heap-based buffer overflow in dnsmasqPriority HIGH 74
- TI-2020-15703 Heap-based buffer overflow in dnsmasqPriority HIGH 69
Show 2 more groups
- Advisory ·
dnsmasq — GLSA-202101-17
7 records Highest priority Priority HIGH 4 HIGH, 3 LOW
Other records, highest priority first
- TI-2020-15697 Heap-based buffer overflow in dnsmasqPriority HIGH 76
- TI-2020-15698 Heap-based buffer overflow in dnsmasqPriority HIGH 74
- TI-2020-15703 Heap-based buffer overflow in dnsmasqPriority HIGH 69
- Advisory ·
dnsmasq — DSA-4844
7 records Highest priority Priority HIGH 4 HIGH, 3 LOW
Other records, highest priority first
- TI-2020-15697 Heap-based buffer overflow in dnsmasqPriority HIGH 76
- TI-2020-15698 Heap-based buffer overflow in dnsmasqPriority HIGH 74
- TI-2020-15703 Heap-based buffer overflow in dnsmasqPriority HIGH 69
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| RHEL 7-based RHEV-H for RHEV 4 (build requirements) | Fixed | RHSA-2021:0395 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:0150 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.1) | Fixed | RHSA-2021:0152 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.2) | Fixed | RHSA-2021:0151 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2021:0153 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2021:0153 |
| Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) | Fixed | RHSA-2021:0155 |
| Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) | Fixed | RHSA-2021:0154 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2021:0153 |
| Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) | Fixed | RHSA-2021:0155 |
| Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) | Fixed | RHSA-2021:0154 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:0153 |
| Red Hat Enterprise Linux Server AUS (v. 7.2) | Fixed | RHSA-2021:0240 |
| Red Hat Enterprise Linux Server AUS (v. 7.3) | Fixed | RHSA-2021:0245 |
| Red Hat Enterprise Linux Server AUS (v. 7.4) | Fixed | RHSA-2021:0156 |
| Red Hat Enterprise Linux Server E4S (v. 7.4) | Fixed | RHSA-2021:0156 |
| Red Hat Enterprise Linux Server EUS (v. 7.6) | Fixed | RHSA-2021:0155 |
| Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | RHSA-2021:0154 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2021:0153 |
| Red Hat Enterprise Linux Server Optional AUS (v. 7.2) | Fixed | RHSA-2021:0240 |
| Red Hat Enterprise Linux Server Optional AUS (v. 7.3) | Fixed | RHSA-2021:0245 |
| Red Hat Enterprise Linux Server Optional AUS (v. 7.4) | Fixed | RHSA-2021:0156 |
| Red Hat Enterprise Linux Server Optional E4S (v. 7.4) | Fixed | RHSA-2021:0156 |
| Red Hat Enterprise Linux Server Optional EUS (v. 7.6) | Fixed | RHSA-2021:0155 |
| Red Hat Enterprise Linux Server Optional EUS (v. 7.7) | Fixed | RHSA-2021:0154 |
| Red Hat Enterprise Linux Server Optional TUS (v. 7.4) | Fixed | RHSA-2021:0156 |
| Red Hat Enterprise Linux Server TUS (v. 7.4) | Fixed | RHSA-2021:0156 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2021:0153 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2021:0153 |
| Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) | Fixed | RHSA-2021:0155 |
| Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) | Fixed | RHSA-2021:0155 |
| Red Hat Virtualization 4 Hypervisor for RHEL 7 | Fixed | RHSA-2021:0395 |
| Red Hat Virtualization 4 Hypervisor for RHEL 8 | Fixed | RHSA-2021:0401 |
Not affected: 7 products
- RHEL 7-based RHEV-H for RHEV 4 (build requirements)
- RHEL 8-based RHEV-H for RHEV 4 (build requirements)
- Red Hat Enterprise Linux 9
- Red Hat OpenStack Platform 10 (Newton)
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat Virtualization 4 Hypervisor for RHEL 8
- Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts
Timeline
- 2026-10-02 Threatist record created from CVE-2020-25685
- 2026-10-03 Alias added: GHSA-9gxq-wfg7-72x4
References
Sources
- CVE-2020-25685 · CVE Program
- CVE-2020-25685 · NVD
- FIRST EPSS
- GHSA-9gxq-wfg7-72x4 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-25685 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences