In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet.
This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 3
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Openstack Designate
cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*
|
1.0.0
|
20.0.2
|
|
Openstack Designate
cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*
|
21.0.0
|
21.0.1
|
|
Openstack Designate
cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*
|
22.0.0
|
22.0.2
|