From: Otto Moerbeek Date: Tue, 28 Mar 2023 07:51:38 +0000 (+0200) Subject: Prep for PowerDNS Security Advisory 2023-02 X-Git-Tag: rec-4.9.0-alpha1~21^2~1 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=955093f2622956fddadc161fee9ba26039a11788;p=thirdparty%2Fpdns.git Prep for PowerDNS Security Advisory 2023-02 --- diff --git a/docs/secpoll.zone b/docs/secpoll.zone index 9e20c1bc90..aac0af0f9f 100644 --- a/docs/secpoll.zone +++ b/docs/secpoll.zone @@ -1,4 +1,4 @@ -@ 86400 IN SOA pdns-public-ns1.powerdns.com. peter\.van\.dijk.powerdns.com. 2023032101 10800 3600 604800 10800 +@ 86400 IN SOA pdns-public-ns1.powerdns.com. peter\.van\.dijk.powerdns.com. 2023032901 10800 3600 604800 10800 @ 3600 IN NS pdns-public-ns1.powerdns.com. @ 3600 IN NS pdns-public-ns2.powerdns.com. @@ -324,25 +324,28 @@ recursor-4.6.0-rc1.security-status 60 IN TXT "3 Unsupported recursor-4.6.0.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-01.html" recursor-4.6.1.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-02.html" recursor-4.6.2.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-02.html" -recursor-4.6.3.security-status 60 IN TXT "1 OK" -recursor-4.6.4.security-status 60 IN TXT "1 OK" -recursor-4.6.5.security-status 60 IN TXT "1 OK" +recursor-4.6.3.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2023-02.html" +recursor-4.6.4.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2023-02.html" +recursor-4.6.5.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2023-02.html" +recursor-4.6.6.security-status 60 IN TXT "1 OK" recursor-4.7.0-alpha1.security-status 60 IN TXT "3 Unsupported pre-release (known vulnerabilities)" recursor-4.7.0-beta1.security-status 60 IN TXT "3 Unsupported pre-release (known vulnerabilities)" recursor-4.7.0-rc1.security-status 60 IN TXT "3 Unsupported pre-release (known vulnerabilities)" recursor-4.7.0.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-02.html" recursor-4.7.1.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-02.html" -recursor-4.7.2.security-status 60 IN TXT "1 OK" -recursor-4.7.3.security-status 60 IN TXT "1 OK" -recursor-4.7.4.security-status 60 IN TXT "1 OK" +recursor-4.7.2.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2023-02.html" +recursor-4.7.3.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2023-02.html" +recursor-4.7.4.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2023-02.html" +recursor-4.7.5.security-status 60 IN TXT "1 OK" recursor-4.8.0-alpha1.security-status 60 IN TXT "3 Unsupported pre-release (known vulnerabilities)" recursor-4.8.0-beta1.security-status 60 IN TXT "3 Unsupported pre-release (known vulnerabilities)" recursor-4.8.0-beta2.security-status 60 IN TXT "3 Unsupported pre-release (known vulnerabilities)" recursor-4.8.0-rc1.security-status 60 IN TXT "3 Unsupported pre-release (known vulnerabilities)" recursor-4.8.0.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2023-01.html" -recursor-4.8.1.security-status 60 IN TXT "1 OK" -recursor-4.8.2.security-status 60 IN TXT "1 OK" -recursor-4.8.3.security-status 60 IN TXT "1 OK" +recursor-4.8.1.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2023-02.html" +recursor-4.8.2.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2023-02.html" +recursor-4.8.3.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2023-02.html" +recursor-4.8.4.security-status 60 IN TXT "1 OK" ; Recursor Debian recursor-3.6.2-2.debian.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/3/security/powerdns-advisory-2015-01/ and https://doc.powerdns.com/3/security/powerdns-advisory-2016-02/" diff --git a/pdns/recursordist/docs/changelog/4.6.rst b/pdns/recursordist/docs/changelog/4.6.rst index cd433237a1..4372face88 100644 --- a/pdns/recursordist/docs/changelog/4.6.rst +++ b/pdns/recursordist/docs/changelog/4.6.rst @@ -1,6 +1,16 @@ Changelogs for 4.6.X ==================== +.. changelog:: + :version: 4.6.6 + :released: 29th of March 2023 + + .. change:: + :tags: Bug Fixes + :pullreq: 12702 + + PowerDNS Security Advisory 2023-02: Deterred spoofing attempts can lead to authoritative servers being marked unavailable. + .. changelog:: :version: 4.6.5 :released: 25th of November 2022 diff --git a/pdns/recursordist/docs/changelog/4.7.rst b/pdns/recursordist/docs/changelog/4.7.rst index 9a605e7ad4..f30e8f1568 100644 --- a/pdns/recursordist/docs/changelog/4.7.rst +++ b/pdns/recursordist/docs/changelog/4.7.rst @@ -1,6 +1,16 @@ Changelogs for 4.7.X ==================== +.. changelog:: + :version: 4.7.5 + :released: 29th of March 2023 + + .. change:: + :tags: Bug Fixes + :pullreq: 12701 + + PowerDNS Security Advisory 2023-02: Deterred spoofing attempts can lead to authoritative servers being marked unavailable. + .. changelog:: :version: 4.7.4 :released: 25th of November 2022 diff --git a/pdns/recursordist/docs/changelog/4.8.rst b/pdns/recursordist/docs/changelog/4.8.rst index 1bbf0623bf..888633f8d4 100644 --- a/pdns/recursordist/docs/changelog/4.8.rst +++ b/pdns/recursordist/docs/changelog/4.8.rst @@ -1,6 +1,16 @@ Changelogs for 4.8.X ==================== +.. changelog:: + :version: 4.8.4 + :released: 29th of March 2023 + + .. change:: + :tags: Bug Fixes + :pullreq: 12700 + + PowerDNS Security Advisory 2023-02: Deterred spoofing attempts can lead to authoritative servers being marked unavailable. + .. changelog:: :version: 4.8.3 :released: 7th of March 2023 diff --git a/pdns/recursordist/docs/security-advisories/powerdns-advisory-2023-02.rst b/pdns/recursordist/docs/security-advisories/powerdns-advisory-2023-02.rst new file mode 100644 index 0000000000..f2c4dcc094 --- /dev/null +++ b/pdns/recursordist/docs/security-advisories/powerdns-advisory-2023-02.rst @@ -0,0 +1,28 @@ +PowerDNS Security Advisory 2023-02: Deterred spoofing attempts can lead to authoritative servers being marked unavailable +========================================================================================================================= + +- CVE: CVE-2023-26437 +- Date: 29th of March 2023 +- Affects: PowerDNS Recursor up to and including 4.6.5, 4.7.4 and 4.8.3 +- Not affected: PowerDNS Recursor 4.6.6, 4.7.5 and 4.8.4 +- Severity: Low +- Impact: Denial of service +- Exploit: Successful spoofing may lead to authoritative servers being marked unavailable +- Risk of system compromise: None +- Solution: Upgrade to patched version + +When the recursor detects and deters a spoofing attempt or receives certain malformed DNS packets, +it throttles the server that was the target of the impersonation attempt so that other authoritative +servers for the same zone will be more likely to be used in the future, in case the attacker +controls the path to one server only. Unfortunately this mechanism can be used by an attacker with +the ability to send queries to the recursor, guess the correct source port of the corresponding +outgoing query and inject packets with a spoofed IP address to force the recursor to mark specific +authoritative servers as not available, leading a denial of service for the zones served by those +servers. + +CVSS 3.0 score: 3.7 (Low) +https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L + +Thanks to Xiang Li from Network and Information Security Laboratory, Tsinghua University for reporting this issue. + +