CVE-2022-33989

MEDIUM

dproxy-nexgen - Insufficient Entropy in UDP Source Port Selection

Title source: llm
STIX 2.1

Description

dproxy-nexgen (aka dproxy nexgen) uses a static UDP source port (selected randomly only at boot time) in upstream queries sent to DNS resolvers. This allows DNS cache poisoning because there is not enough entropy to prevent traffic injection attacks.

References (3)

Core 3
Core References
Third Party Advisory x_refsource_misc
https://sourceforge.net/projects/dproxy/
Exploit, Mailing List, Third Party Advisory x_refsource_misc
https://www.openwall.com/lists/oss-security/2022/08/14/3

Scores

CVSS v3 5.3
EPSS 0.0079
EPSS Percentile 51.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Details

CWE
CWE-331
Status published
Products (1)
dproxy-nexgen_project/dproxy-nexgen
Published Aug 15, 2022
Tracked Since Feb 18, 2026