CVE catalog

CVE-2020-14312

dnsmasq: CVE-2020-14312

[CVE catalog]

Severity
Medium · CVSS 4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
1.23% · Oct 25, 2026

A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandnsmasqsid2.93-3fixed
Debiandnsmasqforky2.93-3fixed
Debiandnsmasqtrixie2.91-1+deb13u2fixed
Debiandnsmasqtrixie-security2.91-1+deb13u1fixed
Debiandnsmasqbookworm2.90-4~deb12u2fixed
Debiandnsmasqbookworm-security2.90-4~deb12u2fixed
Ubuntudnsmasqpro2.66-4ubuntu1vulnerable
Ubuntudnsmasqpro2.67-1vulnerable
Ubuntudnsmasqpro2.68-1vulnerable
Ubuntudnsmasqpro2.68-1ubuntu0.1vulnerable
Ubuntudnsmasqpro2.68-1ubuntu0.2vulnerable
Ubuntudnsmasqpro2.68-1ubuntu0.2+esm1vulnerable
Ubuntudnsmasqpro2.68-1ubuntu0.2+esm2vulnerable
Ubuntudnsmasqpro2.68-1ubuntu0.2+esm3vulnerable
Ubuntudnsmasqpro2.68-1ubuntu0.2+esm5vulnerable
Ubuntudnsmasqpro2.68-1ubuntu0.2+esm6vulnerable
Opensusednsmasqleap 15.22.86-lp152.7.6.1fixed
Susednsmasqlinux enterprise module for basesystem 15 sp22.86-7.14.1fixed
Susednsmasqlinux enterprise module for basesystem 15 sp32.86-7.14.1fixed
Susednsmasqlinux enterprise high performance computing 15 sp1-espos2.86-7.14.1fixed
Susednsmasqlinux enterprise high performance computing 15 sp1-ltss2.86-7.14.1fixed
Susednsmasqlinux enterprise server 15 sp1-bcl2.86-7.14.1fixed
Susednsmasqlinux enterprise server 15 sp1-ltss2.86-7.14.1fixed
Susednsmasqlinux enterprise server for sap applications 15 sp12.86-7.14.1fixed
Susednsmasqlinux enterprise micro 5.02.86-7.14.1fixed
Susednsmasqlinux enterprise micro 5.12.86-7.14.1fixed
Susednsmasqenterprise storage 62.86-7.14.1fixed
Opensusednsmasqtumbleweed2.86-3.1fixed
Opensusednsmasqleap 15.32.86-7.14.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandnsmasqsourcesid2.69-1not yet assignedNot reported[732610]
Debiandnsmasqsourceforky2.69-1not yet assignedNot reported[732610]
Debiandnsmasqsourcetrixie2.69-1not yet assignedNot reported[732610]
Debiandnsmasqsourcebookworm2.69-1not yet assignedNot reported[732610]
Opensusednsmasqrpmleap 15.22.86-lp152.7.6.1Not reportedOPENSUSE-SU-2021:1426-1Not reported
Susednsmasqrpmlinux enterprise module for basesystem 15 sp22.86-7.14.1Not reportedSUSE-SU-2021:3530-1Not reported
Susednsmasqrpmlinux enterprise module for basesystem 15 sp32.86-7.14.1Not reportedSUSE-SU-2021:3530-1Not reported
Susednsmasqrpmlinux enterprise high performance computing 15 sp1-espos2.86-7.14.1Not reportedSUSE-SU-2021:3530-1Not reported
Susednsmasqrpmlinux enterprise high performance computing 15 sp1-ltss2.86-7.14.1Not reportedSUSE-SU-2021:3530-1Not reported
Susednsmasqrpmlinux enterprise server 15 sp1-bcl2.86-7.14.1Not reportedSUSE-SU-2021:3530-1Not reported
Susednsmasqrpmlinux enterprise server 15 sp1-ltss2.86-7.14.1Not reportedSUSE-SU-2021:3530-1Not reported
Susednsmasqrpmlinux enterprise server for sap applications 15 sp12.86-7.14.1Not reportedSUSE-SU-2021:3530-1Not reported
Susednsmasqrpmlinux enterprise micro 5.02.86-7.14.1Not reportedSUSE-SU-2021:3530-1Not reported
Susednsmasqrpmlinux enterprise micro 5.12.86-7.14.1Not reportedSUSE-SU-2021:3530-1Not reported
Susednsmasqrpmenterprise storage 62.86-7.14.1Not reportedSUSE-SU-2021:3530-1Not reported
Opensusednsmasqrpmtumbleweed2.86-3.1Not reportedOPENSUSE-SU-2024:11653-1Not reported
Opensusednsmasqrpmleap 15.32.86-7.14.1Not reportedOPENSUSE-SU-2021:3530-1Not reported

[Debian bug #732610]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [dnsmasq]Unknown
    Details (4)

    • 2.90-4~deb12u2 · all · bookworm

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · bookworm; dsa · dnsmasq · debian · 12

    • 2.90-4~deb12u2 · all · bookworm

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · bookworm; dsa · dnsmasq · debian · 12

    • 2.90-4~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · bookworm; dsa · dnsmasq · debian · 12

    • 2.90-4~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · bookworm; dsa · dnsmasq · debian · 12

  • [dnsmasq-base]Unknown

    Source package: [dnsmasq]

    Details (4)

    • 2.90-4~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · bookworm; dsa · dnsmasq · debian · 12

    • 2.90-4~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · bookworm; dsa · dnsmasq · debian · 12

    • 2.90-4~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · bookworm; dsa · dnsmasq · debian · 12

    • 2.90-4~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · bookworm; dsa · dnsmasq · debian · 12

  • [dnsmasq-base-lua]Unknown

    Source package: [dnsmasq]

    Details (4)

    • 2.90-4~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · bookworm; dsa · dnsmasq · debian · 12

    • 2.90-4~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · bookworm; dsa · dnsmasq · debian · 12

    • 2.90-4~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · bookworm; dsa · dnsmasq · debian · 12

    • 2.90-4~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · bookworm; dsa · dnsmasq · debian · 12

  • [dnsmasq-utils]Unknown

    Source package: [dnsmasq]

    Details (4)

    • 2.90-4~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · bookworm; dsa · dnsmasq · debian · 12

    • 2.90-4~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · bookworm; dsa · dnsmasq · debian · 12

    • 2.90-4~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · bookworm; dsa · dnsmasq · debian · 12

    • 2.90-4~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · bookworm; dsa · dnsmasq · debian · 12

[Debian 13 (Trixie)]

  • [dnsmasq]Unknown
    Details (4)

    • 2.91-1+deb13u1 · all · trixie

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · 13

    • 2.91-1+deb13u1 · all · trixie

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · 13

    • 2.91-1+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · 13

    • 2.91-1+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · 13

  • [dnsmasq-base]Unknown

    Source package: [dnsmasq]

    Details (4)

    • 2.91-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · 13

    • 2.91-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · 13

    • 2.91-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · 13

    • 2.91-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · 13

  • [dnsmasq-base-lua]Unknown

    Source package: [dnsmasq]

    Details (4)

    • 2.91-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · 13

    • 2.91-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · 13

    • 2.91-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · 13

    • 2.91-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · 13

  • [dnsmasq-utils]Unknown

    Source package: [dnsmasq]

    Details (4)

    • 2.91-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · 13

    • 2.91-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · 13

    • 2.91-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · 13

    • 2.91-1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.69-1

      dsa · dnsmasq · debian · 13

[openSUSE Tumbleweed]

  • [dnsmasq]Unknown

    Source package: [dnsmasq]

    Details (1)

    • 2.93-2.3 · x86_64 · tumbleweed

      Fixed · Fixed: 2.86-3.1

      dsa · dnsmasq · opensuse · tumbleweed

  • [dnsmasq-utils]Unknown

    Source package: [dnsmasq]

    Details (1)

    • 2.93-2.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.86-3.1

      Version impact unknown

      dsa · dnsmasq · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]