When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer (AXFR or IXFR) over DNS over HTTPS, causing the process to stop and thus leading to a Denial of Service. DNS over HTTPS is not enabled by default, and backends are using plain DNS (Do53) by default.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-73b41ae8e5 advisory.

    Update to latest upstream

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-4ffc26d8cb advisory.

    Update to latest upstream

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-4d68c5928c advisory.

    Update to latest upstream

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f2d8342f-1134-11ef-8791-6805ca2fa271 advisory.

  - When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a     tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a     request for a zone transfer (AXFR or IXFR) over DNS over HTTPS, causing the process to stop and thus     leading to a Denial of Service. DNS over HTTPS is not enabled by default, and backends are using plain DNS     (Do53) by default. (CVE-2024-25581)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211023	Fedora 41 : dnsdist (2024-73b41ae8e5)	Nessus	Fedora Local Security Checks	high
209182	Fedora 40 : dnsdist (2024-4ffc26d8cb)	Nessus	Fedora Local Security Checks	high
209181	Fedora 39 : dnsdist (2024-4d68c5928c)	Nessus	Fedora Local Security Checks	high
197099	FreeBSD : dnsdist -- Transfer requests received over DoH can lead to a denial of service (f2d8342f-1134-11ef-8791-6805ca2fa271)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2024-25581

high

Tenable Plugins

high

high

high

high