Aller au contenu
en Se connecter
7.5 Élevée

CVE-2025-11232 To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at…

Description

To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.

Produits et versions touchés

Produit Versions touchées Corrigé en
Kea 3.1 3.1.1 → 3.1.2 3.1.0
Kea 3.0.1 3.0.0
Kea 2.7 premières → < 2.7.0 2.7.0
Kea 2.6 premières → < 2.6.0 2.6.0

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Kea

Les 9 CVE de Kea →
CVE-2026-3608 Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any… 7.5 Élevée CVE-2025-40779 If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the… 7.5 Élevée CVE-2025-32803 In some cases, Kea log files or lease files may be world-readable 4.0 Moyenne CVE-2025-32802 Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea 6.1 Moyenne
Suivre cette CVE