CVE-2019-3871
Medium
Description
A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend, allowing a remote user to cause a denial of service by making the server connect to an invalid endpoint, or possibly information disclosure by making the server connect to an internal endpoint and somehow extracting meaningful information about the response
SeverityMedium
CVSS6.5
Exploit probability—
Product
Powerdns Authoritative Server
PublishedMar 21, 2019
First seenMar 21, 2019
Weakness typeCWE-20Improper input validation
How to fix
Update
- powerdns authoritative_server4.0.7, 4.1.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| powerdns authoritative_server | v < 4.0.7, 4.1.0 ≤ v < 4.1.7 | 4.0.7, 4.1.7 |
| fedoraproject fedora | 28, 29 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.