{
  "document": {
    "aggregate_severity": {
      "text": "High"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux7els/vex/2020/cve-2020-25681-els_os-oraclelinux7els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-25T05:35:30Z",
      "generator": {
        "date": "2026-10-25T05:35:30Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2020-25681-ELS_OS-ORACLELINUX7ELS",
      "initial_release_date": "2020-01-01T00:00:00Z",
      "revision_history": [
        {
          "date": "2020-01-01T00:00:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-25T05:35:30Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2020-25681"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Oracle Linux 7",
                "product": {
                  "name": "Oracle Linux 7",
                  "product_id": "Oracle-Linux-7",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Oracle Linux"
          }
        ],
        "category": "vendor",
        "name": "Oracle Corporation"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
                "product": {
                  "name": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
                  "product_id": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/dnsmasq-utils@2.76-17.0.3.el7_9.99.tuxcare.els5?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
                "product": {
                  "name": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
                  "product_id": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/dnsmasq@2.76-17.0.3.el7_9.99.tuxcare.els5?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
                "product": {
                  "name": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
                  "product_id": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/dnsmasq-utils@2.76-17.0.3.el7_9.99.tuxcare.els5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
                "product": {
                  "name": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
                  "product_id": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/dnsmasq@2.76-17.0.3.el7_9.99.tuxcare.els5?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686 as a component of Oracle Linux 7",
          "product_id": "Oracle-Linux-7:dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686"
        },
        "product_reference": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
        "relates_to_product_reference": "Oracle-Linux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64 as a component of Oracle Linux 7",
          "product_id": "Oracle-Linux-7:dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64"
        },
        "product_reference": "dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
        "relates_to_product_reference": "Oracle-Linux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686 as a component of Oracle Linux 7",
          "product_id": "Oracle-Linux-7:dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686"
        },
        "product_reference": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
        "relates_to_product_reference": "Oracle-Linux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64 as a component of Oracle Linux 7",
          "product_id": "Oracle-Linux-7:dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64"
        },
        "product_reference": "dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
        "relates_to_product_reference": "Oracle-Linux-7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-25681",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "TuxCare has assessed that this vulnerability does not impact any currently supported TuxCare products. This evaluation may change as new information becomes available. For additional details regarding this vulnerability and affected products, refer to the provided references.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "Oracle-Linux-7:dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
          "Oracle-Linux-7:dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
          "Oracle-Linux-7:dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
          "Oracle-Linux-7:dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2020-25681"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=1881875",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1881875"
        },
        {
          "category": "external",
          "summary": "https://lists.debian.org/debian-lts-announce/2021/03/msg00027.html",
          "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00027.html"
        },
        {
          "category": "external",
          "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGB7HL3OWHTLEPSMLDGOMXQKG3KM2QME/",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGB7HL3OWHTLEPSMLDGOMXQKG3KM2QME/"
        },
        {
          "category": "external",
          "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYW3IR6APUSKOYKL5FT3ACTIHWHGQY32/",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYW3IR6APUSKOYKL5FT3ACTIHWHGQY32/"
        },
        {
          "category": "external",
          "summary": "https://security.gentoo.org/glsa/202101-17",
          "url": "https://security.gentoo.org/glsa/202101-17"
        },
        {
          "category": "external",
          "summary": "https://www.debian.org/security/2021/dsa-4844",
          "url": "https://www.debian.org/security/2021/dsa-4844"
        },
        {
          "category": "external",
          "summary": "https://www.jsof-tech.com/disclosures/dnspooq/",
          "url": "https://www.jsof-tech.com/disclosures/dnspooq/"
        },
        {
          "category": "external",
          "summary": "https://www.kb.cert.org/vuls/id/434904",
          "url": "https://www.kb.cert.org/vuls/id/434904"
        }
      ],
      "release_date": "2021-01-20T17:15:00Z",
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        },
        {
          "category": "impact",
          "date": "2026-10-15T19:48:44.682529Z",
          "details": "important",
          "product_ids": [
            "Oracle-Linux-7:dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
            "Oracle-Linux-7:dnsmasq-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64",
            "Oracle-Linux-7:dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.i686",
            "Oracle-Linux-7:dnsmasq-utils-0:2.76-17.0.3.el7_9.99.tuxcare.els5.x86_64"
          ]
        }
      ]
    }
  ]
}