PT-2022-18313 · Powerdns+5 · Powerdns Authoritative Server+6

Dmitry Shabanov + 1 · Published 2022-01-18 · Updated 2025-01-14 · CVE-2022-27227

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PowerDNS Authoritative Server versions 4.4.2 and earlier, 4.5.x before 4.5.4, 4.6.x before 4.6.1 PowerDNS Recursor versions 4.4.7 and earlier, 4.5.x before 4.5.8, 4.6.x before 4.6.1

Description The issue is caused by insufficient validation of an IXFR end condition, leading to incomplete zone transfers being handled as successful transfers.

Recommendations For PowerDNS Authoritative Server versions 4.4.2 and earlier, update to version 4.4.3 or later. For PowerDNS Authoritative Server versions 4.5.x before 4.5.4, update to version 4.5.4 or later. For PowerDNS Authoritative Server versions 4.6.x before 4.6.1, update to version 4.6.1 or later. For PowerDNS Recursor versions 4.4.7 and earlier, update to version 4.4.8 or later. For PowerDNS Recursor versions 4.5.x before 4.5.8, update to version 4.5.8 or later. For PowerDNS Recursor versions 4.6.x before 4.6.1, update to version 4.6.1 or later.

Fix

Related Identifiers

ALT-PU-2022-2644

ALT-PU-2022-3173

CVE-2022-27227

OPENSUSE-SU-2022:0105-1

OPENSUSE-SU-2022_0104-1

OPENSUSE-SU-2024:11954-1

OPENSUSE-SU-2024:11955-1

USN-7203-1

Affected Products

Alt Linux

Debian

Linuxmint

Powerdns Authoritative Server

Powerdns Recursor

Suse

Ubuntu

References · 31

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QKN56VWXUVFOYGUN75N5IRNK66OHTHT · Vendor Advisory
• https://doc.powerdns.com/authoritative/security-advisories/index.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2022/03/25/1 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-27227 · Vendor Advisory
• https://docs.powerdns.com/recursor/security-advisories/index.html · Vendor Advisory
• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-01.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-27227 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11954-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14626 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27227 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPHOFNI7FKM5NNOVDOWO4TBXFAFICCUE · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEABZA46XYEUWMGSY2GYYVHISBVWEHIO · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14644 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7203-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7203-1 · Vendor Advisory