Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion
Vulnerability Description
CoreDNS is a DNS server that chains plugins. Starting in version 1.2.0 and prior to version 1.12.4, the CoreDNS etcd plugin contains a TTL confusion vulnerability where lease IDs are incorrectly used as TTL values, enabling DNS cache pinning attacks. This effectively creates a DoS condition for DNS resolution of affected services. The `TTL()` function in `plugin/etcd/etcd.go` incorrectly casts etcd lease IDs (64-bit integers) to uint32 and uses them as TTL values. Large lease IDs become very large TTLs when cast to uint32. This enables cache pinning attacks. Version 1.12.4 contains a fix for the issue.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Vulnerability Type
数值类型间的不正确转换
Vulnerability Title
CoreDNS 安全漏洞
Vulnerability Description
CoreDNS是CoreDNS社区的一个 DNS 服务器。 CoreDNS 1.2.0至1.12.4之前版本存在安全漏洞，该漏洞源于etcd插件TTL混淆，可能导致DNS缓存固定攻击和拒绝服务。
CVSS Information
N/A
Vulnerability Type
N/A