GitHub Advisoryadvisory · crates.io
GHSA-g5jh-57wm-p79m Missing connection timeout in Aardvark-dns
HIGH
Official page ↗
- Aliases
- CVE-2024-8418
- Ecosystem
- crates.io
- Packages
- aardvark-dns
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400
- Reviewed
- 2024-09-04
Affected packages
• crates.io aardvark-dns: >= 1.12.0, < 1.12.2 → fixed in 1.12.2
Description
A flaw was found in Aardvark-dns versions 1.12.0 and 1.12.1. They contain a denial of service vulnerability due to serial processing of TCP DNS queries. This flaw allows a malicious client to keep a TCP connection open indefinitely, causing other DNS queries to time out and resulting in a denial of service for all other containers using aardvark-dns.
Related
Alias · CVE (1)
- CVE-2024-8418 A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. vulnerability
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-8418 advisory
- https://github.com/containers/aardvark-dns/issues/500 web
- https://github.com/containers/aardvark-dns/pull/503 web
- https://github.com/containers/aardvark-dns/commit/aa109bbd6743abd7027e589cc4b871dd2dce7d50 web
- https://access.redhat.com/errata/RHSA-2025:7094 web
- https://access.redhat.com/security/cve/CVE-2024-8418 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2309683 web
- https://github.com/containers/aardvark-dns package