An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check that the TSIG record is the last one, leading to the possibility of parsing records that are not covered by the TSIG signature.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade pdns-recursorUpgrade pdns | Sep 11, 2018 | Sep 11, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 11, 2018 |
| Debian | — | Upgrade pdns-recursorUpgrade pdns | Jan 14, 2017 | Jan 13, 2017 |
| Freebsd | — | Upgrade powerdns-recursorUpgrade powerdns | Jan 19, 2017 | Jan 18, 2017 |
| Suse | — | Upgrade pdns-backend-ldap-debuginfoUpgrade pdns-backend-postgresqlUpgrade pdns-backend-postgresql-debuginfoUpgrade pdns-backend-mysqlUpgrade pdns-backend-sqlite3-debuginfoUpgrade pdns-backend-mysql-debuginfoUpgrade pdns-backend-mydns-debuginfoUpgrade pdnsUpgrade pdns-backend-mydnsUpgrade pdns-debuginfoUpgrade pdns-backend-ldapUpgrade pdns-backend-luaUpgrade pdns-backend-sqlite3Upgrade pdns-backend-lua-debuginfoUpgrade pdns-debugsource | Jan 19, 2017 | Jan 13, 2017 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Sep 11, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub