Null pointer accces in aggressive NSEC(3) cache
A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.
- Обновитесь до 5.4.1-1
Опубликовано Обновлено
PatchFirst · Свежие уязвимости
Уязвимости pdns-recursor · Страница 2
За последние 30 дней в pdns-recursor опубликовано уязвимостей: 7; в каталоге KEV: 0.
Уязвимостей: 75
Insufficient input validation of internal webserver
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
- Обновитесь до 5.3.0-1
Опубликовано ОбновленоConcurrent modification of RPZ data can lead to denial of servce
Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.
- Обновитесь до 5.4.1-1
Опубликовано ОбновленоCrafted zones can cause increased resource usage
By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches.
- Обновитесь до 5.4.1-1
Опубликовано ОбновленоInsufficient input validation of internal webserver
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
- Обновитесь до 5.3.0-1
Опубликовано ОбновленоUnbounded memory allocation by internal web server
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
- Обновитесь до 5.4.1-1
Опубликовано ОбновленоInsufficient validation of zonemd record
If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service.
- Обновитесь до 5.4.1-1
Опубликовано ОбновленоNull pointer dereference in RPZ transfer
An RPZ sent by a malicious authoritative server can result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service.
- Обновитесь до 5.4.1-1
Опубликовано ОбновленоCrafted delegations or IP fragments can poison cached delegations in Recursor
Crafted delegations or IP fragments can poison cached delegations in Recursor.
- Обновитесь до 5.3.1-1
Опубликовано ОбновленоCrafted delegations or IP fragments can poison cached delegations in Recursor
Crafted delegations or IP fragments can poison cached delegations in Recursor.
- Обновитесь до 5.3.1-1
Опубликовано ОбновленоCrafted zones can lead to increased incoming network traffic
Crafted zones can lead to increased incoming network traffic.
- Обновитесь до 5.3.5-1
Опубликовано ОбновленоCrafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor
Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor.
- Обновитесь до 5.3.5-1
Опубликовано ОбновленоInternal logic flaw in cache management can lead to a denial of service in PowerDNS Recursor
An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then send a query with qtype set to ANY.
- Обновитесь до 5.3.3-1
Опубликовано ОбновленоInsufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor
An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.
- Обновитесь до 5.3.3-1
Опубликовано ОбновленоA Recursor configured to send out ECS enabled queries can be sensitive to spoofing attempts
An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries. The updated version include various mitigations against spoofing attempts of ECS enabled queries by chaining ECS enabled requests and enforcing stricter validation of the received answers. The most strict mitigation done when the new setting outgoing.edns_subnet_harden (old style name edns-subnet-harden) is enabled.
- Обновитесь до 5.2.4-2
Опубликовано ОбновленоA crafted zone can lead to an illegal memory access in the PowerDNS Recursor
An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses and crash of the Recursor, causing a denial of service. The remedy is: upgrade to the patched 5.2.1 version. We would like to thank Volodymyr Ilyin for bringing this issue to our attention.
- Обновитесь до 5.2.1-1
Опубликовано ОбновленоCrafted responses can lead to a denial of service due to cache inefficiencies in the Recursor
An attacker can publish a zone containing specific Resource Record Sets. Repeatedly processing and caching results for these sets can lead to a denial of service.
- Обновитесь до 5.0.9-1
Опубликовано ОбновленоCrafted responses can lead to a denial of service in Recursor if recursive forwarding is configured
A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected.
- Обновитесь до 4.9.5-1
Опубликовано ОбновленоCVE-2023-50868
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
- Обновитесь до 4.9.3-1
Опубликовано ОбновленоCVE-2023-50387
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
- Обновитесь до 4.9.3-1
Опубликовано Обновлено
Проверьте свой сервер
Сопоставьте установленный стек и версии со свежими базами уязвимостей.