PT-2020-16230 · Powerdns+1 · Powerdns Recursor+1

Published 2020-10-16 · Updated 2024-07-01 · CVE-2020-25829

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PowerDNS Recursor versions 4.1.x through 4.1.17 PowerDNS Recursor versions 4.2.x through 4.2.4 PowerDNS Recursor versions 4.3.x through 4.3.4

Description A remote attacker can cause the cached records for a given name to be updated to the Bogus DNSSEC validation state, instead of their actual DNSSEC Secure state, via a DNS ANY query. This results in a denial of service for installations that always validate (dnssec=validate), and for clients requesting validation when on-demand validation is enabled (dnssec=process).

Recommendations For PowerDNS Recursor versions 4.1.x through 4.1.17, update to version 4.1.18 or later. For PowerDNS Recursor versions 4.2.x through 4.2.4, update to version 4.2.5 or later. For PowerDNS Recursor versions 4.3.x through 4.3.4, update to version 4.3.5 or later.

Fix

Related Identifiers

CVE-2020-25829

DLA-3855-1

MGASA-2020-0393

OPENSUSE-SU-2020:1687-1

OPENSUSE-SU-2020_1687-1

OPENSUSE-SU-2024:11157-1

Affected Products

Powerdns Recursor

Suse

References · 39

• https://osv.dev/vulnerability/CVE-2020-25829 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25829 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-25829 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-25829 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00036.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1687-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-25829 · Security Note
• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-07.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11157-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0393.html · Security Note
• https://osv.dev/vulnerability/DLA-3855-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202012-19 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0393 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25829 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-25829 · Vendor Advisory