SB20230818194 - Fedora EPEL 8 update for pdns-recursor
Published: August 18, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2022-27227)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of an incoming IXFR transfer. A remote attacker can pass specially crafted input to the server and cause incomplete zone transfer to be handled as successful transfers.
2) Improper Handling of Exceptional Conditions (CVE-ID: CVE-2022-37428)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to incorrect exceptions handling with enabled protobuf logging. A remote attacker can send a specially crafted request to the DNS server and perform a denial of service (DoS) attack.
3) Insufficient verification of data authenticity (CVE-ID: CVE-2023-26437)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists in the code responsible for protection against spoofing attacks. A remote attacker can send specially crafted DNS queries with spoofed IP address to force the PowerDNS Recursor to mark specific authoritative servers as not available, leading to a denial of service condition.
Remediation
Install update from vendor's website.