PT-2018-13774 · Powerdns+1 · Powerdns Recursor+1

Andrej Nemec · Published 2018-12-03 · Updated 2024-06-15 · CVE-2018-16855

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PowerDNS Recursor versions prior to 4.1.8

Description A remote attacker can trigger an out-of-bounds memory read by sending a DNS query, which can cause a crash while the software computes the hash of the query for a packet cache lookup.

Recommendations For versions prior to 4.1.8, update to version 4.1.8 or later to resolve the issue.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2018-16855

MGASA-2019-0009

OPENSUSE-SU-2018:4062-1

OPENSUSE-SU-2018:4177-1

OPENSUSE-SU-2018_4152-1

OPENSUSE-SU-2024:11157-1

Affected Products

Powerdns Recursor

Suse

References · 50

• https://nvd.nist.gov/vuln/detail/CVE-2018-16855 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16855 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11157-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2018:4062-1 · Vendor Advisory
• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-09.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-16855 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-16855 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-16855 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/U5BJ2CLRPCLSDHOH3VAABZZP4GVKGLL5 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16855 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2018:4177-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-16855 · Security Note
• https://advisories.mageia.org/MGASA-2019-0009.html · Security Note
• https://osv.dev/vulnerability/MGASA-2019-0009 · Vendor Advisory
• https://bugzilla.suse.com/1114157 · Note