dproxy-nexgen (aka dproxy nexgen) re-uses the DNS transaction id (TXID) value from client queries, which allows attackers (able to send queries to the resolver) to conduct DNS cache-poisoning attacks because the TXID value is known to the attacker.
References
| Link | Resource |
|---|---|
| https://sourceforge.net/projects/dproxy/ | Product Third Party Advisory |
| https://www.openwall.com/lists/oss-security/2022/08/14/3 | Exploit Mailing List Third Party Advisory |
| https://www.usenix.org/conference/usenixsecurity22/presentation/jeitner | Third Party Advisory |
Configurations
History
17 Aug 2022, 21:05
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.usenix.org/conference/usenixsecurity22/presentation/jeitner - Third Party Advisory | |
| References | (MISC) https://sourceforge.net/projects/dproxy/ - Product, Third Party Advisory | |
| References | (MISC) https://www.openwall.com/lists/oss-security/2022/08/14/3 - Exploit, Mailing List, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-444 | |
| CPE | cpe:2.3:a:dproxy-nexgen_project:dproxy-nexgen:-:*:*:*:*:*:*:* | |
| First Time |
Dproxy-nexgen Project dproxy-nexgen
Dproxy-nexgen Project |
15 Aug 2022, 15:54
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-08-15 13:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-33988
Mitre link : CVE-2022-33988
CVE.ORG link : CVE-2022-33988
JSON object : View
Products Affected
dproxy-nexgen_project
- dproxy-nexgen
CWE
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')