CVE-2023-32077CWE-321

Netmaker has Hardcoded DNS Secret Key

High · published August 24, 2023

CVSS v3.1
7.5
EPSS
4%
Percentile
89.2
In the wild
Unconfirmed
What it is

Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6. If users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.03534 · 89.2th percentile
Weakness
CWE-321 · Use of Hard-coded Cryptographic Key
Published
2023-08-24T21:23Z
EPSS history
Timeline
  • 24 AUG 21:23Z
    Netmaker has Hardcoded DNS Secret Key
    cvelistv5