CVE-2024-0874

Coredns: cd bit response is cached and served later

State: Published
Severity: 5.3 Medium
Published: Apr 25, 2024
Updated: Oct 13, 2026
Reserved: Jan 24, 2024

Description

A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	redhat

Weaknesses

CWE-524 Use of Cache Containing Sensitive Information

Affected Products

Product	Versions
coredns	before 1.11.2Affected
Red Hat OpenShift Container Platform 4.13Red Hat	v4.13.0-202408260940.p0.ge70f097.assembly.stream.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.14Red Hat	v4.14.0-202408260910.p0.gfdd6037.assembly.stream.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.15Red Hat	v4.15.0-202407230407.p0.g1326282.assembly.stream.el9 and laterNot affected
Red Hat OpenShift Container Platform 4.16Red Hat	v4.16.0-202406131906.p0.g04d84f7.assembly.stream.el9 and laterNot affected
Logging Subsystem for Red Hat OpenShiftRed Hat
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat

References

RHSA-2024:0041vendor-advisory
RHSA-2024:4850vendor-advisory
RHSA-2024:6009vendor-advisory
RHSA-2024:6406vendor-advisory
https://access.redhat.com/security/cve/CVE-2024-0874vdb-entry
RHBZ#2219234issue-tracking
https://github.com/coredns/coredns/issues/6186
https://github.com/coredns/coredns/pull/6354

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.