PT-2018-10142 · Powerdns+4 · Powerdns Recursor+5

Pedro Sampaio · Published 2018-11-29 · Updated 2025-01-14 · CVE-2018-10851

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PowerDNS Authoritative Server versions 3.3.0 through 4.1.4 PowerDNS Recursor versions 3.2 through 4.1.4

Description The issue is related to a memory leak that occurs when parsing malformed records, which can lead to a remote denial of service.

Recommendations For PowerDNS Authoritative Server versions 3.3.0 through 4.1.4, update to version 4.1.5 or later to resolve the issue. For PowerDNS Recursor versions 3.2 through 4.1.4, update to version 4.1.5 or later to resolve the issue.

Fix

DoS

Missing Release of Resource after Effective Lifetime

Resource Exhaustion

Weakness Enumeration

CWE-772

CWE-400

Related Identifiers

ALT-PU-2020-1325

ALT-PU-2020-1407

CVE-2018-10851

MGASA-2019-0008

MGASA-2019-0009

OPENSUSE-SU-2018:4062-1

OPENSUSE-SU-2018:4073-1

OPENSUSE-SU-2018:4175-1

OPENSUSE-SU-2018:4177-1

OPENSUSE-SU-2018_4151-1

OPENSUSE-SU-2018_4152-1

OPENSUSE-SU-2018_4156-1

OPENSUSE-SU-2018_4262-1

OPENSUSE-SU-2024:11156-1

OPENSUSE-SU-2024:11157-1

SUSE-RU-2019:0863-1

SUSE-SU-2019:0863-1

SUSE-SU-2020:1066-1

USN-7203-1

Affected Products

Alt Linux

Linuxmint

Powerdns Authoritative Server

Powerdns Recursor

Suse

Ubuntu

References · 154

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1046 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10163 · Security Note
• https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2018-03.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10851 · Security Note
• https://ubuntu.com/security/CVE-2018-14644 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2018:4073-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0009.html · Security Note
• https://osv.dev/vulnerability/CVE-2018-10851 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1046 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14626 · Security Note
• https://bdu.fstec.ru/vul/2019-01943 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/U5BJ2CLRPCLSDHOH3VAABZZP4GVKGLL5 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2018:4177-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7203-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7203-1 · Vendor Advisory