Vulnerability · Published Oct 16, 2020 · Assigned by mitre
CVE-2020-25829
High 7.5
In plain English
A high-severity security flaw in the pdns-recursor package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.5% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. A remote attacker can cause the cached records for a given name to be updated to the Bogus DNSSEC validation state, instead of their actual DNSSEC Secure state, via a DNS ANY query. This results in a denial of service for installation that always validate (dnssec=validate), and for clients requesting validation when on-demand validation is enabled (dnssec=process).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | pdns-recursor | 4.3.5-r0 | ALPINE-CVE-2020-25829 |
| Alpine:v3.21 | pdns-recursor | 4.3.5-r0 | ALPINE-CVE-2020-25829 |
| Alpine:v3.22 | pdns-recursor | 4.3.5-r0 | ALPINE-CVE-2020-25829 |
| Alpine:v3.23 | pdns-recursor | 4.3.5-r0 | ALPINE-CVE-2020-25829 |
| Alpine:v3.24 | pdns-recursor | 4.3.5-r0 | ALPINE-CVE-2020-25829 |
| Debian:12 | pdns-recursor | 4.3.5-1 | DEBIAN-CVE-2020-25829 |
| Debian:13 | pdns-recursor | 4.3.5-1 | DEBIAN-CVE-2020-25829 |
| Debian:14 | pdns-recursor | 4.3.5-1 | DEBIAN-CVE-2020-25829 |
Affected products (as reported)
References
- https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-07.html x_refsource_CONFIRM
- openSUSE-SU-2020:1687 vendor-advisory, x_refsource_SUSE
- GLSA-202012-19 vendor-advisory, x_refsource_GENTOO