Python-dns CVEs and Security Vulnerabilities

CVE-2008-4099

python-PyDNS: insecure DNS transaction ids

PyDNS (aka python-dns) before 2.3.1-4 in Debian GNU/Linux does not use random source ports or transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.

CVSS 2.0 · 6.4 Medium EPSS 2.3% KEV · Not listed

Vendors

Debian

Products

Linux Python-dns

CVE-2008-4126

python-pydns uses insecure DNS source ports

PyDNS (aka python-dns) before 2.3.1-5 in Debian GNU/Linux does not use random source ports for DNS requests and does not use random transaction IDs for DNS retries, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4099.

CVSS 2.0 · 6.4 Medium EPSS 2.2% KEV · Not listed