high7.5
CVE-2020-25829
An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5.
Impact
An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. A remote attacker can cause the cached records for a given name to be updated to the Bogus DNSSEC validation state, instead of their actual DNSSEC Secure state, via a DNS ANY query. This results in a denial of service for installation that always validate (dnssec=validate), and for clients requesting validation when on-demand validation is enabled (dnssec=process).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Powerdns | Recursor | before 4.1.18 from 4.2.0 before 4.2.5 from 4.3.0 before 4.3.5 |
| Opensuse | Backports Sle | Version 15.0 |
| Opensuse | Leap | Versions 15.1, 15.2 |
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00036.html
- https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-07.html
- https://security.gentoo.org/glsa/202012-19
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00036.html
- https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-07.html
- https://security.gentoo.org/glsa/202012-19