CVE-2023-28450: 
NixOS vulnerability analysis and mitigation

An issue was discovered in Dnsmasq before version 2.90, identified as CVE-2023-28450. The vulnerability relates to an incorrect default configuration where the maximum EDNS.0 UDP packet size was set to 4096 bytes instead of the recommended 1232 bytes as specified by DNS Flag Day 2020 (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue specifically relates to the default configuration of EDNS.0 UDP packet size in Dnsmasq, which was set to a value significantly higher than recommended by DNS Flag Day 2020 standards (NVD, Ubuntu).

The misconfiguration of the EDNS.0 UDP packet size could potentially lead to availability issues in DNS services. The high CVSS score primarily reflects the potential impact on system availability, with no direct effect on confidentiality or integrity of the system (NVD).

The vulnerability has been fixed in Dnsmasq version 2.90 and later releases. Various Linux distributions have released security updates to address this issue. For example, Fedora has released updates (dnsmasq-2.89-2) that limit the offered EDNS0 size to 1232 (Fedora).