Backport of CVE-2020-25829 (any-cache-update) to 4.1.x
An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5,
and 4.3.x before 4.3.5. A remote attacker can cause the cached records for a
given name to be updated to the Bogus DNSSEC validation state, instead of their
actual DNSSEC Secure state, via a DNS ANY query. This results in a denial of
service for installation that always validate (dnssec=validate), and for
clients requesting validation when on-demand validation is enabled
(dnssec=process).
Origin: https://github.com/PowerDNS/pdns/commit/
77409aab0be43071b365760213894d6388c3df30.patch
Bug: https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-07.html
Bug-Debian: https://bugs.debian.org/972159
Reviewed-by: Daniel Leidert <dleidert@debian.org>
Gbp-Pq: Name CVE-2020-25829.patch
Backport of acl check to 4.1.x
An issue has been found in PowerDNS Recursor where the ACL applied to the
internal web server via `webserver-allow-from` is not properly enforced,
allowing a remote attacker to send HTTP queries to the internal web server,
bypassing the restriction.
Note that the web server is not enabled by default. Only installations using a
non-default value for `webserver` and `webserver-address` are affected.
Workarounds are: disable the webserver or set a password or an API key.
Additionally, restrict the binding address using the `webserver-address`
setting to local addresses only and/or use a firewall to disallow web requests
from untrusted sources reaching the webserver listening address.
Bug: https://www.openwall.com/lists/oss-security/2020/07/01/1
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=964103
Origin: https://github.com/PowerDNS/pdns/commit/
e81271189216dbf2850c6d4461dfc3f37c731ac8.patch
Reviewed-by: Daniel Leidert <dleidert@debian.org>
Gbp-Pq: Name CVE-2020-14196.patch
projects / pdns-recursor.git / log