Vulnerability Description
An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Powerdns | Recursor | >= 4.1.4, < 4.1.9 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3806Issue TrackingThird Party Advisory
- https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-01Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3806Issue TrackingThird Party Advisory
- https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-01Vendor Advisory
FAQ
What is CVE-2019-3806?
CVE-2019-3806 is a vulnerability with a CVSS score of 8.1 (HIGH). An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly ...
How severe is CVE-2019-3806?
CVE-2019-3806 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-3806?
Check the references section above for vendor advisories and patch information. Affected products include: Powerdns Recursor.