PT-2023-18588 · Powerdns · Powerdns Recursor

Publicado 2023-01-21 · Atualizado 2024-06-15 · CVE-2023-22617

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PowerDNS Recursor version 4.8.0

Description A remote attacker might be able to cause infinite recursion in PowerDNS Recursor via a DNS query that retrieves DS records for a misconfigured domain, because QName minimization is used in QM fallback mode.

Recommendations For PowerDNS Recursor version 4.8.0, update to version 4.8.1 to resolve the issue. As a temporary workaround, consider restricting DNS queries for misconfigured domains to minimize the risk of exploitation.

Correção

Uncontrolled Recursion

Enumeração de Fraquezas

CWE-674

Identificadores relacionados

CVE-2023-22617

OPENSUSE-SU-2024:12628-1

Produtos afetados

Powerdns Recursor

Referências · 17

• https://github.com/PowerDNS/pdns/pull/12442 · Nota
• https://security-tracker.debian.org/tracker/CVE-2023-22617 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-22617 · Nota de Segurança
• https://t.me/cvenotify/42625 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-22617 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:12628-1 · Aviso do Fabricante
• https://docs.powerdns.com/recursor/changelog/4.8.html#change-4.8.1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-22617 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/01/20/1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-22617 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-22617 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2023/01/20/1 · Nota
• https://suse.com/security/cve/CVE-2023-22617 · Nota
• https://docs.powerdns.com/recursor/security-advisories · Aviso do Fabricante
• https://downloads.powerdns.com/patches/2023-01 · Nota