Graylog up to 5.0.8/5.1.2 DNS data authenticity

Summaryinfo

A vulnerability marked as problematic has been reported in Graylog up to 5.0.8/5.1.2. Affected is an unknown function of the component DNS Handler. This manipulation causes data authenticity. This vulnerability is handled as CVE-2023-41045. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Graylog up to 5.0.8/5.1.2. Affected by this vulnerability is an unknown code of the component DNS Handler. The manipulation with an unknown input leads to a data authenticity vulnerability. The CWE definition for the vulnerability is CWE-345. The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. As an impact it is known to affect integrity. The summary by CVE is:

Graylog is a free and open log management platform. Graylog makes use of only one single source port for DNS queries. Graylog binds a single socket for outgoing DNS queries and while that socket is bound to a random port number it is never changed again. This goes against recommended practice since 2008, when Dan Kaminsky discovered how easy is to carry out DNS cache poisoning attacks. In order to prevent cache poisoning with spoofed DNS responses, it is necessary to maximise the uncertainty in the choice of a source port for a DNS query. Although unlikely in many setups, an external attacker could inject forged DNS responses into a Graylog's lookup table cache. In order to prevent this, it is at least recommendable to distribute the DNS queries through a pool of distinct sockets, each of them with a random source port and renew them periodically. This issue has been addressed in versions 5.0.9 and 5.1.3. Users are advised to upgrade. There are no known workarounds for this issue.

The weakness was released 09/01/2023 as GHSA-g96c-x7rh-99r3. The advisory is shared at github.com. This vulnerability is known as CVE-2023-41045 since 08/22/2023. Neither technical details nor an exploit are publicly available.

Upgrading to version 5.0.9 or 5.1.3 eliminates this vulnerability. Applying the patch 466af814523cffae9fbc7e77bab7472988f03c3e is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Graylog

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.0.8
• 5.1.0
• 5.1.1
• 5.1.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion