CVE-2021-4248: DNS NuGet package uses insufficiently random values
9.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.24187%
CWE
Published
12/18/2022
Updated
1/31/2023
KEV Status
No
Technology
C#
C#Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| DNS | nuget | < 7.0.0 | 7.0.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from the use of System.Random in the Request constructor to generate DNS transaction IDs. The commit cf7105a explicitly replaces this with a cryptographically secure RNGCryptoServiceProvider, indicating the constructor's ID generation was the weak point. The CWE-330 classification and advisory descriptions about insufficient PRNG entropy directly align with this code change. The affected code path is clearly shown in the diff where RANDOM.Next() was used for header.Id assignment before patching.