CVE-2018-14626

Source
Severity Medium
Remote Yes
Type Denial of service
Description
An issue has been found in PowerDNS Authoritative Server before 4.1.5 and PowerDNS Recursor before 4.1.5, allowing a remote user to craft a DNS query that will cause an answer without DNSSEC records to be inserted into the packet cache and be returned to clients asking for DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname and qtype. For a DNSSEC-signed domain, this means that DNSSEC validating clients will consider the answer to be bogus until it expires from the packet cache, leading to a denial of service.
Group Package Affected Fixed Severity Status Ticket
AVG-805 powerdns-recursor 4.1.4-3 4.1.5-1 Medium Fixed
AVG-804 powerdns 4.1.4-4 4.1.5-1 Medium Fixed
Date Advisory Group Package Severity Description
12 Nov 2018 ASA-201811-13 AVG-805 powerdns-recursor Medium denial of service
12 Nov 2018 ASA-201811-12 AVG-804 powerdns Medium denial of service
References
https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-2018-05.html
https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-06.html