SB2026082049 - openEuler 24.03 LTS SP4 update for coredns

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082049

SB2026082049 - openEuler 24.03 LTS SP4 update for coredns

Published: August 20, 2026

Security Bulletin ID SB2026082049
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper Authentication (CVE-ID: CVE-2026-35579)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper authentication in the gRPC and QUIC servers when processing TSIG-signed DNS messages. A remote attacker can send a specially crafted request with a valid TSIG key name and a forged MAC to disclose sensitive information.

The issue affects requests where the TSIG key name exists in the configuration, because the HMAC is not computed or compared before the request is treated as verified.


Remediation

Install update from vendor's website.

References