openSUSE-SU-2024:0048-1
See a problem?- Import Source
- https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2024:0048-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/openSUSE-SU-2024:0048-1
- Upstream
- Related
- Published
- 2024-02-14T13:38:11Z
- Modified
- 2026-02-04T02:56:44Z
- Summary
- Security update for pdns-recursor
- Details
-
This update for pdns-recursor fixes the following issues:
Update to 4.8.6:
- fixes case when crafted DNSSEC records in a zone can lead to a denial of service in Recursor https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html (boo#1219823, boo#1219826, CVE-2023-50387, CVE-2023-50868)
Changes in 4.8.5:
- (I)XFR: handle partial read of len prefix.
- YaHTTP: Prevent integer overflow on very large chunks.
- Fix setting of policy tags for packet cache hits.
Changes in 4.8.4:
- Deterred spoofing attempts can lead to authoritative servers being marked unavailable (boo#1209897, CVE-2023-26437)
- References
-
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KZPNQJJ7XX3KPQTYPFVQXAGEDZZNY73R/
- https://bugzilla.suse.com/1209897
- https://bugzilla.suse.com/1219823
- https://bugzilla.suse.com/1219826
- https://www.suse.com/security/cve/CVE-2023-26437
- https://www.suse.com/security/cve/CVE-2023-50387
- https://www.suse.com/security/cve/CVE-2023-50868
Affected packages
SUSE:Package Hub 15 SP5 / pdns-recursor
Package
- Name
- pdns-recursor
- Purl
- pkg:rpm/suse/pdns-recursor&distro=SUSE%20Package%20Hub%2015%20SP5