Skip to content
Fencer Vulns
medium 5.3

CVE-2024-0874 json

Coredns: cd bit response is cached and served later

published 2024-04-25 2 y ago modified 2026-10-13 27 d ago also GHSA-m9w6-wp3h-vq8g , GO-2024-2785 , EUVD-2024-1245

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 55%
public exploits
0
none known

Summary

A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.

Patch / fix

  • go github.com/coredns/coredns 1.11.2
  • Red Hat Red Hat OpenShift Container Platform 4.13 v4.13.0-202408260940.p0.ge70f097.assembly.stream.el8
  • Red Hat Red Hat OpenShift Container Platform 4.14 v4.14.0-202408260910.p0.gfdd6037.assembly.stream.el8
  • Red Hat Red Hat OpenShift Container Platform 4.15 v4.15.0-202407230407.p0.g1326282.assembly.stream.el9
  • Red Hat Red Hat OpenShift Container Platform 4.16 v4.16.0-202406131906.p0.g04d84f7.assembly.stream.el9
  • coredns Package Hub 15 SP6, openSUSE Leap 15.6 1.11.3-bp156.4.3.1

opensuse advisories openSUSE-SU-2024:0319-1

  • coredns Azure Linux 3.0 1.11.1-2
  • coredns CBL-Mariner 2.0 1.11.1-8

azure linux advisories AZL-40201AZL-40222

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-0874 updated cvss 5.3

coredns: CD bit response is cached and served later

  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/lighthouse-agent-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4.13 openshift4/ose-coredns v4.13.0-202408260940.p0.ge70f097.assembly.stream.el8
    fixed: vendor fix RHSA-2024:6009
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-coredns v4.14.0-202408260910.p0.gfdd6037.assembly.stream.el8
    fixed: vendor fix RHSA-2024:6406
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-coredns-rhel9 v4.15.0-202407230407.p0.g1326282.assembly.stream.el9
    fixed: vendor fix RHSA-2024:4850
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-coredns-rhel9 v4.16.0-202406131906.p0.g04d84f7.assembly.stream.el9
    fixed: vendor fix RHSA-2024:0041
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9 Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202408270922-0, openshift4/ose-cli v4.13.0-202408260940.p0.gd192e90.assembly.stream.el8, openshift4/ose-pod v4.13.0-202408260940.p0.ge0953cc.assembly.stream.el8, openshift4/ose-tests v4.13.0-202408260940.p0.gaedd6b8.assembly.stream.el8, openshift4/ose-console v4.13.0-202408260940.p0.g62a2dbc.assembly.stream.el8, openshift4/ose-deployer v4.13.0-202408260940.p0.gd192e90.assembly.stream.el8, +186 more Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202409041930-0, openshift4/ose-cli v4.14.0-202408260910.p0.g44b3ac2.assembly.stream.el8, openshift4/ose-pod v4.14.0-202409041843.p0.g03a907c.assembly.stream.el8, openshift4/ose-tests v4.14.0-202408260910.p0.g3a80e94.assembly.stream.el8, openshift4/ose-console v4.14.0-202409051039.p0.gbeb6e56.assembly.stream.el8, openshift4/ose-deployer v4.14.0-202408260910.p0.g44b3ac2.assembly.stream.el8, +193 more Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202407231021-0, openshift4/ose-console v4.15.0-202407240837.p0.g11a52c9.assembly.stream.el8, openshift4/ose-ironic-rhel9 v4.15.0-202407231208.p0.gea6d005.assembly.stream.el9, openshift4/ose-haproxy-router v4.15.0-202407232037.p0.gdc38fbd.assembly.stream.el8, openshift4/driver-toolkit-rhel9 v4.15.0-202407231006.p0.g7a448c2.assembly.stream.el9, openshift4/ose-ironic-agent-rhel9 v4.15.0-202407231208.p0.g4f8c828.assembly.stream.el9, +6 more Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202406172220-0, openshift4/ose-cli-rhel9 v4.16.0-202406131906.p0.ga245041.assembly.stream.el9, openshift4/ose-pod-rhel9 v4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9, openshift4/ose-sdn-rhel9 v4.16.0-202406131906.p0.g5b658c4.assembly.stream.el9, openshift4/ose-etcd-rhel9 v4.16.0-202406131906.p0.gbc2fec2.assembly.stream.el9, openshift4/ose-tests-rhel9 v4.16.0-202406131906.p0.g3bb691e.assembly.stream.el9, +185 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.76% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
go github.com/coredns/coredns
<1.11.2
1.11.2

Affected products

  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Logging Subsystem for Red Hat OpenShift
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2

Classification

Weakness
  • CWE-524 Use of Cache Containing Sensitive Information

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.