VulnerabilityModified
CVE-2022-30295
uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning.
MEDIUM 6.5EPSS 12.2%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 12.2%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning. This is related to a reset of a value to 0x2.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
- EPSS
- 12.18% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-330
- Affected
- uclibc/uclibc · uclibc-ng project/uclibc-ng
- Source
- cve@mitre.org
References
- https://www.kb.cert.org/vuls/id/473698Third Party Advisory, US Government Resource
- https://www.nozominetworks.com/blog/nozomi-networks-discovers-unpatched-dns-bug-in-popular-c-standard-library-putting-iot-at-risk/Third Party Advisory
- https://www.kb.cert.org/vuls/id/473698Third Party Advisory, US Government Resource
- https://www.nozominetworks.com/blog/nozomi-networks-discovers-unpatched-dns-bug-in-popular-c-standard-library-putting-iot-at-risk/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.