CVE-2018-14626 - log back

CVE-2018-14626 created at 25 Sep 2019 19:31:40
Severity
+ Medium
Remote
+ Remote
Type
+ Denial of service
Description
+ An issue has been found in PowerDNS Authoritative Server before 4.1.5 and PowerDNS Recursor before 4.1.5, allowing a remote user to craft a DNS query that will cause an answer without DNSSEC records to be inserted into the packet cache and be returned to clients asking for DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname and qtype. For a DNSSEC-signed domain, this means that DNSSEC validating clients will consider the answer to be bogus until it expires from the packet cache, leading to a denial of service.
References
+ https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-2018-05.html
+ https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-06.html
Notes