PT-2023-18588 · Powerdns · Powerdns Recursor

Published 2023-01-21 · Updated 2024-06-15 · CVE-2023-22617

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PowerDNS Recursor version 4.8.0

Description A remote attacker might be able to cause infinite recursion in PowerDNS Recursor via a DNS query that retrieves DS records for a misconfigured domain, because QName minimization is used in QM fallback mode.

Recommendations For PowerDNS Recursor version 4.8.0, update to version 4.8.1 to resolve the issue. As a temporary workaround, consider restricting DNS queries for misconfigured domains to minimize the risk of exploitation.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2023-22617

OPENSUSE-SU-2024:12628-1

Affected Products

Powerdns Recursor

References · 17

• https://security-tracker.debian.org/tracker/CVE-2023-22617 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-22617 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22617 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12628-1 · Vendor Advisory
• https://docs.powerdns.com/recursor/changelog/4.8.html#change-4.8.1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-22617 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22617 · Security Note
• https://ubuntu.com/security/CVE-2023-22617 · Vendor Advisory
• https://docs.powerdns.com/recursor/security-advisories · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-22617 · Vendor Advisory
• https://github.com/PowerDNS/pdns/pull/12442 · Note
• https://t.me/cvenotify/42625 · Telegram Post
• http://openwall.com/lists/oss-security/2023/01/20/1 · Note
• https://openwall.com/lists/oss-security/2023/01/20/1 · Note
• https://suse.com/security/cve/CVE-2023-22617 · Note