Vulnerability Description
In PowerDNS Authoritative Server before 4.4.3, 4.5.x before 4.5.4, and 4.6.x before 4.6.1 and PowerDNS Recursor before 4.4.8, 4.5.x before 4.5.8, and 4.6.x before 4.6.1, insufficient validation of an IXFR end condition causes incomplete zone transfers to be handled as successful transfers.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Powerdns | Authoritative Server | < 4.4.3 |
| Powerdns | Recursor | < 4.4.8 |
| Fedoraproject | Fedora | 34 |
References
- http://www.openwall.com/lists/oss-security/2022/03/25/1Mailing ListPatchThird Party Advisory
- https://doc.powerdns.com/authoritative/security-advisories/index.htmlVendor Advisory
- https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-202Vendor Advisory
- https://docs.powerdns.com/recursor/security-advisories/index.htmlVendor Advisory
- https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-01Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- http://www.openwall.com/lists/oss-security/2022/03/25/1Mailing ListPatchThird Party Advisory
- https://doc.powerdns.com/authoritative/security-advisories/index.htmlVendor Advisory
- https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-202Vendor Advisory
- https://docs.powerdns.com/recursor/security-advisories/index.htmlVendor Advisory
- https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-01Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2022-27227?
CVE-2022-27227 is a vulnerability with a CVSS score of 7.5 (HIGH). In PowerDNS Authoritative Server before 4.4.3, 4.5.x before 4.5.4, and 4.6.x before 4.6.1 and PowerDNS Recursor before 4.4.8, 4.5.x before 4.5.8, and 4.6.x before 4.6.1, insufficient validation of an ...
How severe is CVE-2022-27227?
CVE-2022-27227 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-27227?
Check the references section above for vendor advisories and patch information. Affected products include: Powerdns Authoritative Server, Powerdns Recursor, Fedoraproject Fedora.