CVE-2018-10851

Description

PowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.1.5 and 4.0.6, and PowerDNS Recursor 3.2 up to 4.1.4 excluding 4.1.5 and 4.0.9, are vulnerable to a memory leak while parsing malformed records that can lead to remote denial of service.

CVSS Metrics

• v3.0•MEDIUM•Score: 5.3CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
• v3.0•HIGH•Score: 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 0.11%• Percentile: 29%

Techniques & Countermeasures

• CWE-772•Missing Release of Resource after Effective Lifetime

  The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

• CWE-400•Uncontrolled Resource Consumption

  The product does not properly control the allocation and maintenance of a limited resource.

Affected Systems

• powerdns•authoritative

  ≥ 3.3, ≤ 4.1.4

• powerdns•recursor

  ≥ 3.2, ≤ 4.1.4

• the powerdns project•pdns

  3.3.0 to 4.1.4, excluding 4.1.5 and 4.0.6

• the powerdns project•pdns-recursor

  3.2 to 4.1.4, excluding 4.1.5 and 4.0.9

References (3)

• https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-04.html
• https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2018-03.html
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10851