x/vulndb: potential Go vuln in github.com/coredns/coredns: GHSA-hfmw-7g3m-gj6q

[GoVulnBot]

Advisory GHSA-hfmw-7g3m-gj6q references a vulnerability in the following Go modules:

Module
github.com/coredns/coredns

Description:
An issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing denial of service for normal resolution. In an exploit, the attacker could just forge a response targeting the source port of a vulnerable resolver without the need to guess the correct TXID.

References:

• ADVISORY: GHSA-hfmw-7g3m-gj6q
• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2023-28452
• FIX: coredns/coredns@604a902
• WEB: https://coredns.io
• WEB: https://gist.github.com/idealeer/e41c7fb3b661d4262d0b6f21e12168ba

Cross references:

• github.com/coredns/coredns appears in 4 other report(s):
  • data/excluded/GO-2023-1606.yaml (x/vulndb: potential Go vuln in github.com/coredns/coredns: GHSA-ch7v-37xg-75ph #1606) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2023-1610.yaml (x/vulndb: potential Go vuln in github.com/coredns/coredns: GHSA-h828-v5pv-33qx #1610) EFFECTIVELY_PRIVATE
  • data/reports/GO-2022-0368.yaml (x/vulndb: potential Go vuln in github.com/coredns/coredns: GHSA-gv9j-4w24-q7vx #368)
  • data/reports/GO-2024-2785.yaml (x/vulndb: potential Go vuln in github.com/coredns/coredns: CVE-2024-0874 #2785)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/coredns/coredns
      versions:
        - fixed: 1.11.0
      vulnerable_at: 1.10.1
summary: CoreDNS vulnerable to TuDoor Attacks in github.com/coredns/coredns
cves:
    - CVE-2023-28452
ghsas:
    - GHSA-hfmw-7g3m-gj6q
references:
    - advisory: https://github.com/advisories/GHSA-hfmw-7g3m-gj6q
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-28452
    - fix: https://github.com/coredns/coredns/commit/604a902e2c7e0317aecaa3666124079c75a31573
    - web: https://coredns.io
    - web: https://gist.github.com/idealeer/e41c7fb3b661d4262d0b6f21e12168ba
source:
    id: GHSA-hfmw-7g3m-gj6q
    created: 2024-09-18T18:01:26.001179285Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/614078 mentions this issue: data/reports: add GO-2024-3130