Bug 2219234 (CVE-2024-0874)

Summary:	CVE-2024-0874 coredns: CD bit response is cached and served later
Product:	[Other] Security Response	Reporter:	TEJ RATHI <trathi>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dfreiber, gparvin, jburrell, jcantril, njean, owatkins, pahickey, rogbas, stcannon, teagle, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2255536
Bug Blocks:	2219503

Description TEJ RATHI 2023-07-03 05:10:52 UTC

Coredns mishandling of CI bit: CD bit response is cached and served later

What happened:
If CD bit is set in query, it disables validation at remote server

What you expected to happen:
CD queries may pass, but the same answer must not be served to queries without CD bit set

https://github.com/coredns/coredns/issues/6186

Comment 4 Anten Skrabec 2023-12-21 17:27:35 UTC

Created golang-github-coredns-corefile-migration tracking bugs for this issue:

Affects: fedora-all [bug 2255536]

Comment 5 errata-xmlrpc 2024-06-27 11:23:36 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.16

Via RHSA-2024:0041 https://access.redhat.com/errata/RHSA-2024:0041

Comment 6 errata-xmlrpc 2024-07-31 00:29:34 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.15

Via RHSA-2024:4850 https://access.redhat.com/errata/RHSA-2024:4850

Comment 7 errata-xmlrpc 2024-09-04 07:57:04 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2024:6009 https://access.redhat.com/errata/RHSA-2024:6009

Comment 8 errata-xmlrpc 2024-09-11 18:34:17 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2024:6406 https://access.redhat.com/errata/RHSA-2024:6406