x/vulndb: potential Go vuln in github.com/coredns/coredns: GHSA-hfmw-7g3m-gj6q

Advisory GHSA-hfmw-7g3m-gj6q references a vulnerability in the following Go modules:

Module
github.com/coredns/coredns

Description: An issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing denial of service for normal resolution. In an exploit, the attacker could just forge a response targeting the source port of a vulnerable resolver without the need to guess the correct TXID.

References:

Cross references:

github.com/coredns/coredns appears in 4 other report(s):
- data/excluded/GO-2023-1606.yaml (https://github.com/golang/vulndb/issues/1606) EFFECTIVELY_PRIVATE
- data/excluded/GO-2023-1610.yaml (https://github.com/golang/vulndb/issues/1610) EFFECTIVELY_PRIVATE
- data/reports/GO-2022-0368.yaml (https://github.com/golang/vulndb/issues/368)
- data/reports/GO-2024-2785.yaml (https://github.com/golang/vulndb/issues/2785)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/coredns/coredns
      versions:
        - fixed: 1.11.0
      vulnerable_at: 1.10.1
summary: CoreDNS vulnerable to TuDoor Attacks in github.com/coredns/coredns
cves:
    - CVE-2023-28452
ghsas:
    - GHSA-hfmw-7g3m-gj6q
references:
    - advisory: https://github.com/advisories/GHSA-hfmw-7g3m-gj6q
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-28452
    - fix: https://github.com/coredns/coredns/commit/604a902e2c7e0317aecaa3666124079c75a31573
    - web: https://coredns.io
    - web: https://gist.github.com/idealeer/e41c7fb3b661d4262d0b6f21e12168ba
source:
    id: GHSA-hfmw-7g3m-gj6q
    created: 2024-09-18T18:01:26.001179285Z
review_status: UNREVIEWED

golang / vulndb

x/vulndb: potential Go vuln in github.com/coredns/coredns: GHSA-hfmw-7g3m-gj6q #3130