Designate
Monthly
Cross-tenant DNS hijacking and denial of service in OpenStack Designate before 22.0.1 allows an authenticated tenant to bypass zone-ownership and duplicate-zone checks. Because the `_is_subzone`, `_is_superzone`, and duplicate-zone database constraint are evaluated only against the target pool, a user can schedule a zone to a different pool via the AttributeFilter scheduler and create a zone that overlaps another tenant's, redirecting DNS traffic to attacker-controlled IPs or forcing NODATA responses. Fixed versions (22.0.1, 21.0.1, 20.0.2) are available from the vendor; no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Denial-of-service in OpenStack Designate's mDNS handler allows unauthenticated remote disruption of DNS resolution across all tenants sharing an affected pool path. The handler performs pool-blind zone lookups: when two zones with the same name exist across different pools - a condition reachable either through a separate cross-tenant zone overlap vulnerability or via legitimate cross-pool configurations - the lookup fails deterministically, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify trigger is reachable via a single unauthenticated UDP packet, with no public exploit code identified at time of analysis and no confirmed active exploitation in the CISA KEV catalog.
Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas when processing an internal zone file transfer, which might. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-tenant DNS hijacking and denial of service in OpenStack Designate before 22.0.1 allows an authenticated tenant to bypass zone-ownership and duplicate-zone checks. Because the `_is_subzone`, `_is_superzone`, and duplicate-zone database constraint are evaluated only against the target pool, a user can schedule a zone to a different pool via the AttributeFilter scheduler and create a zone that overlaps another tenant's, redirecting DNS traffic to attacker-controlled IPs or forcing NODATA responses. Fixed versions (22.0.1, 21.0.1, 20.0.2) are available from the vendor; no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Denial-of-service in OpenStack Designate's mDNS handler allows unauthenticated remote disruption of DNS resolution across all tenants sharing an affected pool path. The handler performs pool-blind zone lookups: when two zones with the same name exist across different pools - a condition reachable either through a separate cross-tenant zone overlap vulnerability or via legitimate cross-pool configurations - the lookup fails deterministically, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify trigger is reachable via a single unauthenticated UDP packet, with no public exploit code identified at time of analysis and no confirmed active exploitation in the CISA KEV catalog.
Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas when processing an internal zone file transfer, which might. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.