CVE-2020-17439

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that the incoming DNS replies match outgoing DNS queries in newdata() in resolv.c. Also, arbitrary DNS replies are parsed if there was any outgoing DNS query with a transaction ID that matches the transaction ID of an incoming reply. Provided that the default DNS cache is quite small (only four records) and that the transaction ID has a very limited set of values that is quite easy to guess, this can lead to DNS cache poisoning.

• CWE-20

• https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01Third Party Advisory, US Government Resource
• https://www.kb.cert.org/vuls/id/815128Third Party Advisory, US Government Resource
• https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01Third Party Advisory, US Government Resource
• https://www.kb.cert.org/vuls/id/815128Third Party Advisory, US Government Resource

Published

Dec 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-17433This vulnerability allows remote attackers to disclose sensi…7.8
• CVE-2020-17434This vulnerability allows remote attackers to disclose sensi…7.8
• CVE-2020-17435This vulnerability allows remote attackers to disclose sensi…7.8
• CVE-2020-17436This vulnerability allows remote attackers to disclose sensi…7.8
• CVE-2020-17437An issue was discovered in uIP 1.0, as used in Contiki 3.0 a…8.2
• CVE-2020-17438An issue was discovered in uIP 1.0, as used in Contiki 3.0 a…9.8
• CVE-2020-1744A flaw was found in keycloak before version 9.0.1. When conf…5.6
• CVE-2020-17440An issue was discovered in uIP 1.0, as used in Contiki 3.0 a…7.5
• CVE-2020-17441An issue was discovered in picoTCP 1.7.0. The code for proce…9.1
• CVE-2020-17442An issue was discovered in picoTCP 1.7.0. The code for parsi…7.5
• CVE-2020-17443An issue was discovered in picoTCP 1.7.0. The code for creat…7.5
• CVE-2020-17444An issue was discovered in picoTCP 1.7.0. The routine for pr…7.5