Threats tagged 'ghsa-9gm5-9rfh-m6vx'

CoreDNS versions prior to 1.14.7 improperly accepted DNS UPDATE messages over DoH, DoH3, DoQ, and DNS-over-gRPC transports, allowing unauthenticated clients to send DNS UPDATE requests through the proxy/forward plugin to upstream DNS servers. This bypassed the opcode rejection enforced on UDP and TCP transports, potentially enabling unauthorized DNS record modifications if the upstream trusts CoreDNS's source or connection without end-to-end TSIG authentication. A fix is available that enforces the correct request policy on all affected transports before dispatch.