CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-12244
https://notcve.org/view.php?id=CVE-2020-12244
An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer, allowing an attacker to bypass DNSSEC validation. Se detectó un problema en PowerDNS Recursor versiones 4.1.0 hasta 4.3.0, donde los registros en la sección de respuestas de una respuesta NXDOMAIN que carece de SOA no fueron comprobados apropiadamente en las función SyncRes::processAnswer, permitiendo a un atacante omitir la comprobación DNSSEC. • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00052.html http://www.openwall.com/lists/oss-security/2020/05/19/3 https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-02.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMP72NJGKBWR5WEBXAWX5KSLQUDFTG6S https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PS4ZN5XGENYNFKX7QIIOUCQQHXE37GJF https://www.debian.org/security/2020/dsa-4691 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 7.5EPSS: 1%CPEs: 10EXPL: 0CVE-2020-12662 – unbound: amplification of an incoming query into a large number of queries directed to a target
https://notcve.org/view.php?id=CVE-2020-12662
Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records. Unbound versiones anteriores a 1.10.1, presenta un Control Insuficiente del Volumen de Mensajes de Red, también se conoce como un problema de "NXNSAttack". Esto es activado por subdominios aleatorios en NSDNAME en registros NS. A network amplification vulnerability was found in Unbound, in the way it processes delegation messages from one authoritative zone to another. • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.html http://www.nxnsattack.com http://www.openwall.com/lists/oss-security/2020/05/19/5 https://lists.debian.org/debian-lts-announce/2021/02/msg00017.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F5NFROI2OMCZLYRTCNGHGO3TUD32LCIQ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/ • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 1%CPEs: 10EXPL: 0CVE-2020-12663 – unbound: infinite loop via malformed DNS answers received from upstream servers
https://notcve.org/view.php?id=CVE-2020-12663
Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. Unbound versiones anteriores a 1.10.1, presenta un bucle infinito mediante respuestas DNS malformadas recibidas desde servidores aguas arriba. A flaw was found in unbound in versions prior to 1.10.1. An infinite loop can be created when malformed DNS answers are received from upstream servers. The highest threat from this vulnerability is to system availability. • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.html http://www.openwall.com/lists/oss-security/2020/05/19/5 https://lists.debian.org/debian-lts-announce/2021/02/msg00017.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F5NFROI2OMCZLYRTCNGHGO3TUD32LCIQ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJ42N2HBZ3DXMSEC56SWIIOFQGOS5M7I h • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 6.0EPSS: 0%CPEs: 5EXPL: 0CVE-2020-10726 – dpdk: librte_vhost VHOST_USER_GET_INFLIGHT_FD message flooding to result in a DoS
https://notcve.org/view.php?id=CVE-2020-10726
A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access to the vhost-user socket can keep sending VHOST_USER_GET_INFLIGHT_FD messages, causing a resource leak (file descriptors and virtual memory), which may result in a denial of service. Se detectó una vulnerabilidad en DPDK versiones 19.11 y superiores. Un contenedor malicioso que presenta acceso directo al socket vhost-user puede seguir enviando mensajes de VHOST_USER_GET_INFLIGHT_FD, causando una filtración de recursos (descriptores de archivos y memoria virtual), lo que puede resultar en una denegación de servicio. • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html https://bugs.dpdk.org/show_bug.cgi?id=271 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10726 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRHKFVV4MRWNNJOYQOVP64L4UVWYPEO4 https://www.openwall.com/lists/oss-security/2020/05/18/2 https://www.oracle.com/security-alerts/cpujan2021.html https://access.redhat.com/security/cve/CVE-2020-10726 https://bugzilla.redhat.com • CWE-190: Integer Overflow or Wraparound CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.7EPSS: 0%CPEs: 5EXPL: 0CVE-2020-10725 – dpdk: librte_vhost Malicious guest could cause segfault by sending invalid Virtio descriptor
https://notcve.org/view.php?id=CVE-2020-10725
A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity check of the descriptor address in the function `virtio_dev_rx_batch_packed()`. Se detectó un fallo en DPDK versión 19.11 y superior, que permite a un invitado malicioso causar un fallo de segmentación de la aplicación backend vhost-user que se ejecuta en el host, lo que podría resultar en una pérdida de conectividad para los otros invitados ejecutados en ese host. Esto es causado por una falta de comprobación de la validez de la dirección del descriptor en la función "virtio_dev_rx_batch_packed()". • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html https://bugs.dpdk.org/show_bug.cgi?id=270 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10725 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRHKFVV4MRWNNJOYQOVP64L4UVWYPEO4 https://www.openwall.com/lists/oss-security/2020/05/18/2 https://www.oracle.com/security-alerts/cpujan2021.html https://access.redhat.com/security/cve/CVE-2020-10725 https://bugzilla.redhat.com • CWE-665: Improper Initialization •