A vulnerability was found in PowerDNS Authoritative Server before 4.0.7...
Vulnerability Description
A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend, allowing a remote user to cause a denial of service by making the server connect to an invalid endpoint, or possibly information disclosure by making the server connect to an internal endpoint and somehow extracting meaningful information about the response
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-3871
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.openwall.com/lists/oss-security/2019/03/18/4
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3871
- https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-03.html
- http://www.securityfocus.com/bid/107491
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWUHF6MRSQ3YO7UUISGLV7MXCAGBW2VD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ROFI6OTWF4GKONNSNEDUCW6LVSSEBZNF/
- https://lists.debian.org/debian-lts-announce/2019/03/msg00039.html
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00022.html
- https://www.debian.org/security/2019/dsa-4424
- https://seclists.org/bugtraq/2019/Apr/8
Affected Vendor
The PowerDNS Project
View all reports →