Reliance on Reverse DNS Resolution for a Security-Critical Action in Lightbend - CVE-2023-31442
Published: February 5, 2025
Vulnerability identifier: #VU103643
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-31442
CWE-ID: CWE-350
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to async-dns resolver (used by Discovery in DNS mode and transitively by Cluster Bootstrap) uses predictable DNS transaction IDs when resolving DNS records. A remote attacker can exploit the vulnerability to perform a denial of service attack.
Affected software
Lightbend
Dell Data Protection Central
IBM Cloud Application Performance Management (APM)
IBM Cloud Pak for Business Automation
Dell Data Protection Central
IBM Cloud Application Performance Management (APM)
IBM Cloud Pak for Business Automation
How to mitigate CVE-2023-31442
Install updates from vendor's website.
Lightbend - update to 2.8.1
Dell Data Protection Central - update to 19.12.0-2
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.17
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1
Dell Data Protection Central - update to 19.12.0-2
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.17
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1