CVE-2018-10851

Source
Severity Medium
Remote Yes
Type Denial of service
Description
An issue has been found in PowerDNS Authoritative Server before 4.1.5 and PowerDNS Recursor before 4.1.5. The issue is due to the fact that some memory is allocated before the parsing and is not always properly released if the record is malformed.
In the authoritative server case, it allows an authorized user to cause a memory leak by inserting a specially crafted record in a zone under their control, then sending a DNS query for that record. In the case of the recursor, it allows a malicious authoritative server to cause a memory leak by sending specially crafted records.
Group Package Affected Fixed Severity Status Ticket
AVG-805 powerdns-recursor 4.1.4-3 4.1.5-1 Medium Fixed
AVG-804 powerdns 4.1.4-4 4.1.5-1 Medium Fixed
Date Advisory Group Package Severity Description
12 Nov 2018 ASA-201811-13 AVG-805 powerdns-recursor Medium denial of service
12 Nov 2018 ASA-201811-12 AVG-804 powerdns Medium denial of service
References
https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-2018-03.html
https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-04.html