CVE-2022-27227
High
Description
In PowerDNS Authoritative Server before 4.4.3, 4.5.x before 4.5.4, and 4.6.x before 4.6.1 and PowerDNS Recursor before 4.4.8, 4.5.x before 4.5.8, and 4.6.x before 4.6.1, insufficient validation of an IXFR end condition causes incomplete zone transfers to be handled as successful transfers.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Powerdns Authoritative Server
PublishedMar 25, 2022
First seenMar 25, 2022
How to fix
Update
- powerdns authoritative_server4.4.3, 4.5.4, 4.6.1 or later
- powerdns recursor4.4.8, 4.5.8, 4.6.1 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QKN56VWXUVFOYGUN75N5IRNK66OHTHT/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEABZA46XYEUWMGSY2GYYVHISBVWEHIO/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZJSKICB67SPPEGNXCQLZVSWR6QGCN3KP/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPHOFNI7FKM5NNOVDOWO4TBXFAFICCUE/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| powerdns authoritative_server | v < 4.4.3, 4.5.0 ≤ v < 4.5.4, 4.6.0 ≤ v < 4.6.1 | 4.4.3, 4.5.4, 4.6.1 |
| powerdns recursor | v < 4.4.8, 4.5.0 ≤ v < 4.5.8, 4.6.0 ≤ v < 4.6.1 | 4.4.8, 4.5.8, 4.6.1 |
| fedoraproject fedora | 34, 35, 36 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.