An update for dnsmasq is now available for openEuler-20.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2021-1189 Final 1.0 1.0 2021-05-15 Initial 2021-05-15 2021-05-15 openEuler SA Tool V1.0 2021-05-15 dnsmasq security update An update for dnsmasq is now available for openEuler-20.03-LTS-SP1. Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks. Security Fix(es): A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ID to forge a reply and get it accepted by dnsmasq. This flaw makes a DNS Cache Poisoning attack much easier. The highest threat from this vulnerability is to data integrity.(CVE-2021-3448) An update for dnsmasq is now available for openEuler-20.03-LTS-SP1. openEuler Security has rated this update as having a security impact of low. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Low dnsmasq https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1189 https://openeuler.org/en/security/cve/detail.html?id=CVE-2021-3448 https://nvd.nist.gov/vuln/detail/CVE-2021-3448 openEuler-20.03-LTS-SP1 dnsmasq-debugsource-2.82-8.oe1.aarch64.rpm dnsmasq-help-2.82-8.oe1.aarch64.rpm dnsmasq-2.82-8.oe1.aarch64.rpm dnsmasq-debuginfo-2.82-8.oe1.aarch64.rpm dnsmasq-2.82-8.oe1.src.rpm dnsmasq-2.82-8.oe1.x86_64.rpm dnsmasq-debugsource-2.82-8.oe1.x86_64.rpm dnsmasq-help-2.82-8.oe1.x86_64.rpm dnsmasq-debuginfo-2.82-8.oe1.x86_64.rpm A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ID to forge a reply and get it accepted by dnsmasq. This flaw makes a DNS Cache Poisoning attack much easier. The highest threat from this vulnerability is to data integrity. 2021-05-15 CVE-2021-3448 openEuler-20.03-LTS-SP1 Low 4.0 AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N dnsmasq security update 2021-05-15 https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1189