rpm package
opensuse/pdns-recursor&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/pdns-recursor&distro=openSUSE%20Tumbleweed
Vulnerabilities (30)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2016-7068 | — | < 4.5.5-1.3 | 4.5.5-1.3 | Sep 11, 2018 | An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial | ||
| CVE-2017-15094 | — | < 4.5.5-1.3 | 4.5.5-1.3 | Jan 23, 2018 | An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than of | ||
| CVE-2017-15093 | — | < 4.5.5-1.3 | 4.5.5-1.3 | Jan 23, 2018 | When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure | ||
| CVE-2017-15092 | — | < 4.5.5-1.3 | 4.5.5-1.3 | Jan 23, 2018 | A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, alt | ||
| CVE-2017-15090 | — | < 4.5.5-1.3 | 4.5.5-1.3 | Jan 23, 2018 | An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in | ||
| CVE-2018-1000003 | — | < 4.5.5-1.3 | 4.5.5-1.3 | Jan 22, 2018 | Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay. | ||
| CVE-2016-6172 | Med | 6.8 | < 4.0.3-1.2 | 4.0.3-1.2 | Sep 26, 2016 | PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS server crash) via a large (1) AXFR or (2) IXFR response. | |
| CVE-2015-1868 | — | < 4.0.3-1.2 | 4.0.3-1.2 | May 18, 2015 | The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a req | ||
| CVE-2014-8601 | — | < 4.0.3-1.2 | 4.0.3-1.2 | Dec 10, 2014 | PowerDNS Recursor before 3.6.2 does not limit delegation chaining, which allows remote attackers to cause a denial of service ("performance degradations") via a large or infinite number of referrals, as demonstrated by resolving domains hosted by ezdns.it. | ||
| CVE-2009-4009 | — | < 4.0.3-1.2 | 4.0.3-1.2 | Jan 8, 2010 | Buffer overflow in PowerDNS Recursor before 3.1.7.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted packets. |
- CVE-2016-7068Sep 11, 2018affected < 4.5.5-1.3fixed 4.5.5-1.3
An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial
- CVE-2017-15094Jan 23, 2018affected < 4.5.5-1.3fixed 4.5.5-1.3
An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than of
- CVE-2017-15093Jan 23, 2018affected < 4.5.5-1.3fixed 4.5.5-1.3
When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure
- CVE-2017-15092Jan 23, 2018affected < 4.5.5-1.3fixed 4.5.5-1.3
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, alt
- CVE-2017-15090Jan 23, 2018affected < 4.5.5-1.3fixed 4.5.5-1.3
An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in
- CVE-2018-1000003Jan 22, 2018affected < 4.5.5-1.3fixed 4.5.5-1.3
Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay.
- affected < 4.0.3-1.2fixed 4.0.3-1.2
PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS server crash) via a large (1) AXFR or (2) IXFR response.
- CVE-2015-1868May 18, 2015affected < 4.0.3-1.2fixed 4.0.3-1.2
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a req
- CVE-2014-8601Dec 10, 2014affected < 4.0.3-1.2fixed 4.0.3-1.2
PowerDNS Recursor before 3.6.2 does not limit delegation chaining, which allows remote attackers to cause a denial of service ("performance degradations") via a large or infinite number of referrals, as demonstrated by resolving domains hosted by ezdns.it.
- CVE-2009-4009Jan 8, 2010affected < 4.0.3-1.2fixed 4.0.3-1.2
Buffer overflow in PowerDNS Recursor before 3.1.7.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted packets.
Page 2 of 2