Bug 905301 (CVE-2022-2835, CVE-2022-2837)

Summary:	net-dns/coredns: multiple vulnerabilities
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	trivial	CC:	zmedico
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	~4 [??]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2023-04-29 17:10:12 UTC

CVE-2022-2835 (https://bugzilla.redhat.com/show_bug.cgi?id=2118542):

A flaw was found in coreDNS. This flaw allows a malicious user to reroute internal calls to some internal services that were accessed by the FQDN in a format of <service>.<namespace>.svc.

CVE-2022-2837 (https://bugzilla.redhat.com/show_bug.cgi?id=2118543):

A flaw was found in coreDNS. This flaw allows a malicious user to redirect traffic intended for external top-level domains (TLD) to a pod they control by creating projects and namespaces that match the TLD.

The Redhat bug reports are without detail or reference of substance.