CVE-2023-41045

Public Exploit
Insecure source port usage for DNS queries in Graylog

Description

Graylog is a free and open log management platform. Graylog makes use of only one single source port for DNS queries. Graylog binds a single socket for outgoing DNS queries and while that socket is bound to a random port number it is never changed again. This goes against recommended practice since 2008, when Dan Kaminsky discovered how easy is to carry out DNS cache poisoning attacks. In order to prevent cache poisoning with spoofed DNS responses, it is necessary to maximise the uncertainty in the choice of a source port for a DNS query. Although unlikely in many setups, an external attacker could inject forged DNS responses into a Graylog's lookup table cache. In order to prevent this, it is at least recommendable to distribute the DNS queries through a pool of distinct sockets, each of them with a random source port and renew them periodically. This issue has been addressed in versions 5.0.9 and 5.1.3. Users are advised to upgrade. There are no known workarounds for this issue.

Category

3.7
CVSS
Severity: Low
CVSS 3.1 •
EPSS 0.13%
Vendor Advisory github.com
Affected: Graylog2 graylog2-server
Published at:
Updated at:

References

Link Tags
https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-g96c-x7rh-99r3 vendor advisory exploit
https://github.com/Graylog2/graylog2-server/commit/466af814523cffae9fbc7e77bab7472988f03c3e patch
https://github.com/Graylog2/graylog2-server/commit/a101f4f12180fd3dfa7d3345188a099877a3c327 patch

Frequently Asked Questions

What is the severity of CVE-2023-41045?
CVE-2023-41045 has been scored as a low severity vulnerability.
How to fix CVE-2023-41045?
To fix CVE-2023-41045, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2023-41045 being actively exploited in the wild?
It is possible that CVE-2023-41045 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-41045?
CVE-2023-41045 affects Graylog2 graylog2-server.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.