CVE-2020-14312

Name	CVE-2020-14312
Description	A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	732610

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
dnsmasq (PTS)	jessie, jessie (lts)	2.72-3+deb8u7	fixed
	stretch (security)	2.76-5+deb9u3	fixed
	stretch (lts), stretch	2.76-5+deb9u4	fixed
	buster, buster (lts)	2.80-1+deb10u2	fixed
	buster (security)	2.80-1+deb10u1	fixed
	bullseye	2.85-1	fixed
	bookworm	2.89-1	fixed
	sid, trixie	2.90-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
dnsmasq	source	(unstable)	2.69-1			732610

https://bugzilla.redhat.com/show_bug.cgi?id=1851342