Vulnerability Description
In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.
CVSS Score
5.3
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Powerdns | Recursor | <= 4.1.16 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00043.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00042.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00044.html
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00036.html
- https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-04.Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://www.openwall.com/lists/oss-security/2020/07/01/1Mailing ListRelease NotesThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00043.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00042.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00044.html
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00036.html
- https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-04.Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://www.openwall.com/lists/oss-security/2020/07/01/1Mailing ListRelease NotesThird Party Advisory
FAQ
What is CVE-2020-14196?
CVE-2020-14196 is a vulnerability with a CVSS score of 5.3 (MEDIUM). In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.
How severe is CVE-2020-14196?
CVE-2020-14196 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-14196?
Check the references section above for vendor advisories and patch information. Affected products include: Powerdns Recursor.