openSUSE-SU-2019:1128-1 | Mondoo Vulnerability Intelligence

openSUSE-SU-2019:1128-1

HIGH7.0

Security update for pdns

Published Apr 3, 2019

Modified 7 years ago

Fix available

Details

Description of the patch:

This update for pdns fixes the following issue:

Security issue fixed:

CVE-2019-3871: Fixed an insufficient validation in the HTTP remote backend which could allow a remote user to cause the HTTP backend to connect to an attacker-specified host instead of the configured one (bsc#1129734).

Affected Packages

pdns

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0

Fixed in:

4.1.2-bp150.2.6.1

pdns-backend-geoip

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0

Fixed in:

4.1.2-bp150.2.6.1

pdns-backend-godbc

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0

Fixed in:

4.1.2-bp150.2.6.1

pdns-backend-ldap

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0

Fixed in:

4.1.2-bp150.2.6.1

pdns-backend-lua

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0

Fixed in:

4.1.2-bp150.2.6.1

pdns-backend-mydns

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0

Fixed in:

4.1.2-bp150.2.6.1

pdns-backend-mysql

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0

Fixed in:

4.1.2-bp150.2.6.1

pdns-backend-postgresql

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0

Fixed in:

4.1.2-bp150.2.6.1

pdns-backend-remote

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0

Fixed in:

4.1.2-bp150.2.6.1

pdns-backend-sqlite3

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0

Fixed in:

4.1.2-bp150.2.6.1

References

https://bugzilla.suse.com/1129734

https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6HWYPEI7LWADS6EXV3RDYBSB4K4WDP6U/#6HWYPEI7LWADS6EXV3RDYBSB4K4WDP6U

https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6HWYPEI7LWADS6EXV3RDYBSB4K4WDP6U/#6HWYPEI7LWADS6EXV3RDYBSB4K4WDP6U

https://www.suse.com/security/cve/CVE-2019-3871/

https://www.suse.com/support/security/rating/

CVSS Analysis

CVSS v3.0

7.0

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

LowI:L

Availability

HighA:H

7.0/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Upstream

Ecosystems

SUSE Package Hub 12 SP1 SUSE Package Hub 15 openSUSE Leap 15.0

Timeline

PublishedApr 3, 2019

ModifiedApr 3, 2019