Attachment 201327 Details for Bug 235113 – VuXML entry for powerdns-recursor

[patch] VuXML entry for powerdns-recursor

vuxml-1.1_3.diff (text/plain), 2.01 KB, created by Ralf van der Enden on 2019-01-22 10:08:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ralf van der Enden

Created: 2019-01-22 10:08:36 UTC

Size: 2.01 KB

patch

obsolete

>Index: vuln.xml
>===================================================================
>--- vuln.xml	(revision 490436)
>+++ vuln.xml	(working copy)
>@@ -58,6 +58,43 @@
> * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
> -->
> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
>+ <vuln vid="40d92cc5-1e2b-11e9-bef6-6805ca2fa271">
>+ <topic>powerdns-recursor -- multiple vulnerabilities</topic>
>+ <affects>
>+ <package>
>+	<name>powerdns-recursor</name>
>+	<range><lt>4.1.9</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+ <body xmlns="http://www.w3.org/1999/xhtml">
>+	PowerDNS Team reports:
>+	<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.1.html">
>+	 CVE-2019-3806: An issue has been found in PowerDNS Recursor where Lua hooks are
>+	 not properly applied to queries received over TCP in some specific combination of
>+	 settings, possibly bypassing security policies enforced using Lua.
>+
>+	 When the recursor is configured to run with more than one thread (threads=X) and to
>+	 do the distribution of incoming queries to the worker threads itself
>+	 (pdns-distributes-queries=yes), the Lua script is not properly loaded in the thread
>+	 handling incoming TCP queries, causing the Lua hooks to not be properly applied.
>+	 CVE-2019-3807: An issue has been found in PowerDNS Recursor where records in the
>+	 answer section of responses received from authoritative servers with the AA flag not
>+	 set were not properly validated, allowing an attacker to bypass DNSSEC validation.
>+	</blockquote>
>+ </body>
>+ </description>
>+ <references>
>+ <url>https://doc.powerdns.com/recursor/changelog/4.1.html</url>
>+ <cvename>CVE-2019-3806</cvename>
>+ <cvename>CVE-2019-3807</cvename>
>+ </references>
>+ <dates>
>+ <discovery>2019-01-21</discovery>
>+ <entry>2019-01-22</entry>
>+ </dates>
>+ </vuln>
>+
> <vuln vid="383931ba-1818-11e9-92ea-448a5b29e8a9">
> <topic>py-matrix-synapse -- undisclosed vulnerability</topic>
> <affects>

Flags:

tremere: maintainer-approval+

Actions: View | Diff

Attachments on bug 235113: 201324 | 201327 | 201377