openSUSE-SU-2019:1904-1 | Mondoo Vulnerability Intelligence

openSUSE-SU-2019:1904-1

LOW3.5

Security update for pdns

Published Aug 15, 2019

Modified 6 years ago

Fix available

Details

Description of the patch:

This update for pdns fixes the following issues:

Security issues fixed:

CVE-2019-10203: Updated PostgreSQL schema to address a possible denial of service by an authorized user by inserting a crafted record in a MASTER type zone under their control. (boo#1142810)
CVE-2019-10162: Fixed a denial of service but when authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. (boo#1138582)
CVE-2019-10163: Fixed a denial of service of slave server when an authorized master server sends large number of NOTIFY messages. (boo#1138582)

Non-security issues fixed:

Enabled the option to disable superslave support.
Fixed pdnsutil b2b-migrate to not lose NSEC3 settings.

Affected Packages

pdns

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0openSUSE Leap 15.1

Fixed in:

4.1.2-bp150.2.9.1

pdns-backend-geoip

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0openSUSE Leap 15.1

Fixed in:

4.1.2-bp150.2.9.1

pdns-backend-godbc

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0openSUSE Leap 15.1

Fixed in:

4.1.2-bp150.2.9.1

pdns-backend-ldap

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0openSUSE Leap 15.1

Fixed in:

4.1.2-bp150.2.9.1

pdns-backend-lua

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0openSUSE Leap 15.1

Fixed in:

4.1.2-bp150.2.9.1

pdns-backend-mydns

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0openSUSE Leap 15.1

Fixed in:

4.1.2-bp150.2.9.1

pdns-backend-mysql

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0openSUSE Leap 15.1

Fixed in:

4.1.2-bp150.2.9.1

pdns-backend-postgresql

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0openSUSE Leap 15.1

Fixed in:

4.1.2-bp150.2.9.1

pdns-backend-remote

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0openSUSE Leap 15.1

Fixed in:

4.1.2-bp150.2.9.1

pdns-backend-sqlite3

SUSE Package Hub 12 SP1SUSE Package Hub 15openSUSE Leap 15.0openSUSE Leap 15.1

Fixed in:

4.1.2-bp150.2.9.1

References

https://bugzilla.suse.com/1138582

https://bugzilla.suse.com/1142810

https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EYLJ2BERQKZJZX4JVL4OARQ6323JOCJW/#EYLJ2BERQKZJZX4JVL4OARQ6323JOCJW

https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EYLJ2BERQKZJZX4JVL4OARQ6323JOCJW/#EYLJ2BERQKZJZX4JVL4OARQ6323JOCJW

https://www.suse.com/security/cve/CVE-2019-10162/

https://www.suse.com/security/cve/CVE-2019-10163/

https://www.suse.com/security/cve/CVE-2019-10203/

https://www.suse.com/support/security/rating/

CVSS Analysis

CVSS v3.0

3.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

LowA:L

3.5/CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Upstream

CVE-2019-10162 CVE-2019-10163 CVE-2019-10203

Ecosystems

SUSE Package Hub 12 SP1 SUSE Package Hub 15 openSUSE Leap 15.0 openSUSE Leap 15.1

Timeline

PublishedAug 15, 2019

ModifiedAug 15, 2019