CVE-2025-8283: Netavark Has Possible DNS Resolve Confusion
3.7
Basic Information
Technical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| netavark | rust | < 1.15.1 | 1.15.1 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability lies in the netavark package, where the dns.podman search domain was not being added to the container's DNS configuration. This could lead to DNS resolve confusion, where a container's hostname could be resolved to an external IP address. The provided patch in commit 068abc869b736a03a947b5419c102da73830e882 clearly shows the fix being applied in the Bridge::setup function within src/network/bridge.rs. The change involves adding the PODMAN_DEFAULT_SEARCH_DOMAIN to the dns_search_domains in the network setup response. This directly addresses the vulnerability described. The test files were also updated to reflect this change, removing assertions that previously checked for an empty search domain. Therefore, the Bridge::setup function is the vulnerable function as it was responsible for the incorrect DNS configuration.