-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RustRust| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| netavark | rust | < 1.15.1 | 1.15.1 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the netavark package, where the dns.podman search domain was not being added to the container's DNS configuration. This could lead to DNS resolve confusion, where a container's hostname could be resolved to an external IP address. The provided patch in commit 068abc869b736a03a947b5419c102da73830e882 clearly shows the fix being applied in the Bridge::setup function within src/network/bridge.rs. The change involves adding the PODMAN_DEFAULT_SEARCH_DOMAIN to the dns_search_domains in the network setup response. This directly addresses the vulnerability described. The test files were also updated to reflect this change, removing assertions that previously checked for an empty search domain. Therefore, the Bridge::setup function is the vulnerable function as it was responsible for the incorrect DNS configuration.
Ongoing coverage of React2Shell