Miggo Logo

CVE-2025-8283: Netavark Has Possible DNS Resolve Confusion

3.7

CVSS Score
3.1

Basic Information

EPSS Score
0.05933%
Published
7/28/2025
Updated
7/29/2025
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
netavarkrust< 1.15.11.15.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability lies in the netavark package, where the dns.podman search domain was not being added to the container's DNS configuration. This could lead to DNS resolve confusion, where a container's hostname could be resolved to an external IP address. The provided patch in commit 068abc869b736a03a947b5419c102da73830e882 clearly shows the fix being applied in the Bridge::setup function within src/network/bridge.rs. The change involves adding the PODMAN_DEFAULT_SEARCH_DOMAIN to the dns_search_domains in the network setup response. This directly addresses the vulnerability described. The test files were also updated to reflect this change, removing assertions that previously checked for an empty search domain. Therefore, the Bridge::setup function is the vulnerable function as it was responsible for the incorrect DNS configuration.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility w*s *oun* in t** n*t*v*rk p**k***, * n*twork st**k *or *ont*in*rs us** wit* Po*m*n. *u* to *ns.po*m*n s**r** *om*in **in* r*mov**, n*t*v*rk m*y r*turn *xt*rn*l s*rv*rs i* * v*li* */**** r**or* is s*nt *s * r*spons*. W**n *r**tin* * *o

Reasoning

T** vuln*r**ility li*s in t** `n*t*v*rk` p**k***, w**r* t** `*ns.po*m*n` s**r** *om*in w*s not **in* ***** to t** *ont*in*r's *NS *on*i*ur*tion. T*is *oul* l*** to *NS r*solv* *on*usion, w**r* * *ont*in*r's *ostn*m* *oul* ** r*solv** to *n *xt*rn*l I