CVE-2008-4099: Debian Python-DNS

Medium severity, CVSS 6.4. EPSS: 2.3% chance of exploitation in the next 30 days.

PyDNS (aka python-dns) before 2.3.1-4 in Debian GNU/Linux does not use random source ports or transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.

Affected products

• Debian Python-DNS: up to and including 2.3.1-3; version 2.3.0-1 only; version 2.3.0-2 only; version 2.3.0-3 only; version 2.3.0-4 only; version 2.3.0-5 only; …

Published 2008-09-18. Last modified 2026-06-16.