ALAS2-2023-2069

Related Vulnerabilities: CVE-2023-28450  

An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. (CVE-2023-28450)

ALAS2-2023-2069


Amazon Linux 2 Security Advisory: ALAS-2023-2069
Advisory Release Date: 2023-06-05 16:39 Pacific
Advisory Updated Date: 2023-06-07 22:38 Pacific
Severity: Medium

Issue Overview:

An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. (CVE-2023-28450)


Affected Packages:

dnsmasq


Issue Correction:
Run yum update dnsmasq to update your system.

New Packages:
aarch64:
    dnsmasq-2.76-16.amzn2.1.4.aarch64
    dnsmasq-utils-2.76-16.amzn2.1.4.aarch64
    dnsmasq-debuginfo-2.76-16.amzn2.1.4.aarch64

i686:
    dnsmasq-2.76-16.amzn2.1.4.i686
    dnsmasq-utils-2.76-16.amzn2.1.4.i686
    dnsmasq-debuginfo-2.76-16.amzn2.1.4.i686

src:
    dnsmasq-2.76-16.amzn2.1.4.src

x86_64:
    dnsmasq-2.76-16.amzn2.1.4.x86_64
    dnsmasq-utils-2.76-16.amzn2.1.4.x86_64
    dnsmasq-debuginfo-2.76-16.amzn2.1.4.x86_64