openSUSE-SU-2024:0048-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2024:0048-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2024:0048-1
Related
Published
2024-02-14T13:38:11Z
Modified
2024-02-14T13:38:11Z
Summary
Security update for pdns-recursor
Details

This update for pdns-recursor fixes the following issues:

Update to 4.8.6:

  • fixes case when crafted DNSSEC records in a zone can lead to a denial of service in Recursor https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html (boo#1219823, boo#1219826, CVE-2023-50387, CVE-2023-50868)

Changes in 4.8.5:

  • (I)XFR: handle partial read of len prefix.
  • YaHTTP: Prevent integer overflow on very large chunks.
  • Fix setting of policy tags for packet cache hits.

Changes in 4.8.4:

  • Deterred spoofing attempts can lead to authoritative servers being marked unavailable (boo#1209897, CVE-2023-26437)
References

Affected packages

SUSE:Package Hub 15 SP5 / pdns-recursor

Package

Name
pdns-recursor
Purl
pkg:rpm/suse/pdns-recursor&distro=SUSE%20Package%20Hub%2015%20SP5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.8.6-bp155.2.3.1

Ecosystem specific 

{
    "binaries": [
        {
            "pdns-recursor": "4.8.6-bp155.2.3.1"
        }
    ]
}

openSUSE:Leap 15.5 / pdns-recursor

Package

Name
pdns-recursor
Purl
pkg:rpm/opensuse/pdns-recursor&distro=openSUSE%20Leap%2015.5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.8.6-bp155.2.3.1

Ecosystem specific 

{
    "binaries": [
        {
            "pdns-recursor": "4.8.6-bp155.2.3.1"
        }
    ]
}