CVE-2019-3871: fedoraproject fedora Improper Input Validation
Vulnerability summary
CVE-2019-3871 is a high (CVSS 8.8) Improper Input Validation vulnerability in fedoraproject fedora. EPSS estimates a 12.63% chance of exploitation in the next 30 days, higher than 96.2% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 21-03-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend, allowing a remote user to cause a denial of service by making the server connect to an invalid endpoint, or possibly information disclosure by making the server connect to an internal endpoint and somehow extracting meaningful information about the response
CVSS metrics
5 scores · 4 sources · 2 versions- CVE.orgCNA6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
12.63%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 12.63% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (openwall.com)
Maturity: unknown
Exploit Reference (bugzilla.redhat.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Suse2 products
- pdns&distro=SUSE Package Hub 12 SP1< 4.1.2-bp150.2.6.1
- pdns&distro=SUSE Package Hub 15< 4.1.2-bp150.2.6.1
Debian1 product
- pdns< 4.1.6-2 | < 4.0.3-1+deb9u4 | < 3.4.1-4+deb8u9
Fedoraproject1 product
- fedoraEOL28 | 29
Mageia1 product
- pdns< 4.1.7-1.mga6
Opensuse1 product
- pdns&distro=openSUSE Leap 15.0< 4.1.2-bp150.2.6.1
Powerdns1 product
- authoritative_server< 4.0.7 | ≥ 4.1.0, < 4.1.7
The powerdns project1 product
- pdns4.1.7 | 4.0.7
Ubuntu1 product
- pdnsAll versions (No fix recorded)
8 vendors · 9 products
References
20 links- www.openwall.com/lists/oss-security/2019/03/18/4Mailing ListX Refsource MLISTExploitPatchThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3871X Refsource CONFIRMExploitIssue TrackingPatchThird Party Advisory
- doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-03.htmlX Refsource MISCVendor Advisory
Show all 20 references
- lists.opensuse.org/archives/…Advisory