rpm package
suse/pdns-recursor&distro=SUSE Package Hub 15 SP1
pkg:rpm/suse/pdns-recursor&distro=SUSE%20Package%20Hub%2015%20SP1
Vulnerabilities (5)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-25829 | — | < 4.3.5-bp152.2.12.1 | 4.3.5-bp152.2.12.1 | Oct 16, 2020 | An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. A remote attacker can cause the cached records for a given name to be updated to the Bogus DNSSEC validation state, instead of their actual DNSSEC Secure state, via a DNS ANY q | ||
| CVE-2020-14196 | — | < 4.1.12-bp151.4.6.1 | 4.1.12-bp151.4.6.1 | Jul 1, 2020 | In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced. | ||
| CVE-2020-10995 | — | < 4.1.12-bp151.4.3.1 | 4.1.12-bp151.4.3.1 | May 19, 2020 | PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack u | ||
| CVE-2020-10030 | — | < 4.1.12-bp151.4.3.1 | 4.1.12-bp151.4.3.1 | May 19, 2020 | An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. It allows an attacker (with enough privileges to change the system's hostname) to cause disclosure of uninitialized memory content via a stack-based out-of-bounds read. It only occurs on systems where g | ||
| CVE-2020-12244 | — | < 4.1.12-bp151.4.3.1 | 4.1.12-bp151.4.3.1 | May 19, 2020 | An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer, allowing an attacker to bypass DNSSEC validation. |
- CVE-2020-25829Oct 16, 2020affected < 4.3.5-bp152.2.12.1fixed 4.3.5-bp152.2.12.1
An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. A remote attacker can cause the cached records for a given name to be updated to the Bogus DNSSEC validation state, instead of their actual DNSSEC Secure state, via a DNS ANY q
- CVE-2020-14196Jul 1, 2020affected < 4.1.12-bp151.4.6.1fixed 4.1.12-bp151.4.6.1
In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.
- CVE-2020-10995May 19, 2020affected < 4.1.12-bp151.4.3.1fixed 4.1.12-bp151.4.3.1
PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack u
- CVE-2020-10030May 19, 2020affected < 4.1.12-bp151.4.3.1fixed 4.1.12-bp151.4.3.1
An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. It allows an attacker (with enough privileges to change the system's hostname) to cause disclosure of uninitialized memory content via a stack-based out-of-bounds read. It only occurs on systems where g
- CVE-2020-12244May 19, 2020affected < 4.1.12-bp151.4.3.1fixed 4.1.12-bp151.4.3.1
An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer, allowing an attacker to bypass DNSSEC validation.