{"id":"CVE-2024-0874","state":"PUBLISHED","title":"Coredns: cd bit response is cached and served later","description":"A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.","publishedAt":"2024-04-25T16:22:44.182Z","updatedAt":"2026-10-13T02:42:52.805Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"redhat"},"assigner":"redhat","products":["coredns","Red Hat Red Hat OpenShift Container Platform 4.13","Red Hat Red Hat OpenShift Container Platform 4.14","Red Hat Red Hat OpenShift Container Platform 4.15","Red Hat Red Hat OpenShift Container Platform 4.16","Red Hat Logging Subsystem for Red Hat OpenShift","Red Hat Red Hat Advanced Cluster Management for Kubernetes 2"],"affected":[{"packageName":"coredns","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.11.2","versionType":"semver"}],"collectionURL":"https://github.com/coredns/coredns"},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.13","packageName":"openshift4/ose-coredns","defaultStatus":"affected","versions":[{"version":"v4.13.0-202408260940.p0.ge70f097.assembly.stream.el8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.13::el8","cpe:/a:redhat:openshift:4.13::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.14","packageName":"openshift4/ose-coredns","defaultStatus":"affected","versions":[{"version":"v4.14.0-202408260910.p0.gfdd6037.assembly.stream.el8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el8","cpe:/a:redhat:openshift:4.14::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.15","packageName":"openshift4/ose-coredns-rhel9","defaultStatus":"affected","versions":[{"version":"v4.15.0-202407230407.p0.g1326282.assembly.stream.el9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el8","cpe:/a:redhat:openshift:4.15::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.16","packageName":"openshift4/ose-coredns-rhel9","defaultStatus":"affected","versions":[{"version":"v4.16.0-202406131906.p0.g04d84f7.assembly.stream.el9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"]},{"vendor":"Red Hat","product":"Logging Subsystem for Red Hat OpenShift","packageName":"openshift-logging/logging-loki-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:logging:5"]},{"vendor":"Red Hat","product":"Red Hat Advanced Cluster Management for Kubernetes 2","packageName":"rhacm2/lighthouse-agent-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:acm:2"]}],"references":["https://access.redhat.com/errata/RHSA-2024:0041","https://access.redhat.com/errata/RHSA-2024:4850","https://access.redhat.com/errata/RHSA-2024:6009","https://access.redhat.com/errata/RHSA-2024:6406","https://access.redhat.com/security/cve/CVE-2024-0874","https://bugzilla.redhat.com/show_bug.cgi?id=2219234","https://github.com/coredns/coredns/issues/6186","https://github.com/coredns/coredns/pull/6354"],"weaknesses":["CWE-524"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/0xxx/CVE-2024-0874.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-0874","state":"PUBLISHED","datePublished":"2024-04-25T16:22:44.182Z","dateUpdated":"2026-10-13T02:42:52.805Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2024-01-24T23:42:08.424Z"},"containers":{"cna":{"title":"Coredns: cd bit response is cached and served later","descriptions":[{"lang":"en","value":"A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching."}],"affected":[{"packageName":"coredns","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.11.2","versionType":"semver"}],"collectionURL":"https://github.com/coredns/coredns"},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.13","packageName":"openshift4/ose-coredns","defaultStatus":"affected","versions":[{"version":"v4.13.0-202408260940.p0.ge70f097.assembly.stream.el8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.13::el8","cpe:/a:redhat:openshift:4.13::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.14","packageName":"openshift4/ose-coredns","defaultStatus":"affected","versions":[{"version":"v4.14.0-202408260910.p0.gfdd6037.assembly.stream.el8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el8","cpe:/a:redhat:openshift:4.14::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.15","packageName":"openshift4/ose-coredns-rhel9","defaultStatus":"affected","versions":[{"version":"v4.15.0-202407230407.p0.g1326282.assembly.stream.el9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el8","cpe:/a:redhat:openshift:4.15::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.16","packageName":"openshift4/ose-coredns-rhel9","defaultStatus":"affected","versions":[{"version":"v4.16.0-202406131906.p0.g04d84f7.assembly.stream.el9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"]},{"vendor":"Red Hat","product":"Logging Subsystem for Red Hat OpenShift","packageName":"openshift-logging/logging-loki-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:logging:5"]},{"vendor":"Red Hat","product":"Red Hat Advanced Cluster Management for Kubernetes 2","packageName":"rhacm2/lighthouse-agent-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:acm:2"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:0041","name":"RHSA-2024:0041","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4850","name":"RHSA-2024:4850","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6009","name":"RHSA-2024:6009","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6406","name":"RHSA-2024:6406","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-0874","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2219234","name":"RHBZ#2219234","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/coredns/coredns/issues/6186"},{"url":"https://github.com/coredns/coredns/pull/6354"}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-524","description":"Use of Cache Containing Sensitive Information","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-10-13T02:42:52.805Z"},"datePublic":"2023-07-03T00:00:00.000Z","x_redhatCweChain":"CWE-524: Use of Cache Containing Sensitive Information","timeline":[{"lang":"en","time":"2023-07-03T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2023-07-03T00:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"This issue was discovered by Petr Mensik (Red Hat)."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-07-13T20:18:31.995445Z","id":"CVE-2024-0874","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-13T20:18:37.906Z"}},{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/errata/RHSA-2024:0041","name":"RHSA-2024:0041","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-0874","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2219234","name":"RHBZ#2219234","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]},{"url":"https://github.com/coredns/coredns/issues/6186","tags":["x_transferred"]},{"url":"https://github.com/coredns/coredns/pull/6354","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T18:18:18.998Z"}}]}}}