-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| DNS | nuget | < 7.0.0 | 7.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the use of System.Random in the Request constructor to generate DNS transaction IDs. The commit cf7105a explicitly replaces this with a cryptographically secure RNGCryptoServiceProvider, indicating the constructor's ID generation was the weak point. The CWE-330 classification and advisory descriptions about insufficient PRNG entropy directly align with this code change. The affected code path is clearly shown in the diff where RANDOM.Next() was used for header.Id assignment before patching.