CVE-2023-41045 Insecure source port usage for DNS queries in Graylog
An attacker can inject forged DNS responses into Graylog's lookup table cache due to static source port usage, potentially altering data or bypassing security checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-41045?
CVE-2023-41045 is a low-severity vulnerability in graylog2-server, published on 31 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Graylog is a free and open log management platform. Graylog makes use of only one single source port for DNS queries. Graylog binds a single socket for outgoing DNS queries and while that socket is bound to a random port number it is never changed again. This goes against recommended practice since 2008, when Dan Kaminsky discovered how easy is to carry out DNS cache poisoning attacks. In order to prevent cache poisoning with spoofed DNS responses, it is necessary to maximise the uncertainty in the choice of a source port for a DNS query. Although unlikely in many setups, an external attacker could inject forged DNS responses into a Graylog's lookup table cache. In order to prevent this, it is at least recommendable to distribute the DNS queries through a pool of distinct sockets, each of them with a random source port and renew them periodically. This issue has been addressed in versions 5.0.9 and 5.1.3. Users are advised to upgrade. There are no known workarounds for this issue.
Weakness: CWE-345
Which versions are affected by CVE-2023-41045?
4 open source packages ship an affected version, including org.graylog2:graylog2-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.graylog2:graylog2-server Maven | All versions | 5.0.9 |
org.graylog2:graylog2-server Maven | All versions | 5.0.9 |
org.graylog2:graylog2-server Maven | From 5.1.0 | 5.1.3 |
org.graylog2:graylog2-server Maven | From 5.1.0 | 5.1.3 |
Products include Graylog Graylog.
How do I fix CVE-2023-41045?
Upgrade org.graylog2:graylog2-server to a fixed version for your release line: 5.0.9 or 5.1.3.
Is CVE-2023-41045 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-41045 exists.
Other vulnerabilities in graylog2-server
- CVE-2021-37759 Information disclosure in n/a
- CVE-2021-37760 Information disclosure in n/a
- CVE-2026-1435 Incorrect management of session invalidation vulnerability in Graylog Web Interface
- CVE-2025-53106 Graylog vulnerable to privilege escalation through API tokens
- CVE-2024-24824 graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request
Sources
Also known as GHSA-g96c-x7rh-99r3.