openSUSE-SU-2020:1556-1

MEDIUM4.3

Security update for pdns

Published Sep 27, 2020

Modified 5 years ago

Fix available

Details

Description of the patch:

This update for pdns fixes the following issues:

Build with libmaxminddb instead of the obsolete GeoIP (boo#1156196)
CVE-2020-17482: Fixed an error that can result in leaking of uninitialised memory through crafted zone records (boo#1176535)
Backported compilation fix vs. latest Boost 1.74 (boo#1176312)

Affected Packages

pdns

SUSE Package Hub 12 SP1SUSE Package Hub 15 SP1SUSE Package Hub 15 SP2openSUSE Leap 15.1openSUSE Leap 15.2

Fixed in:

4.3.1-bp152.2.5.1

pdns-backend-geoip

SUSE Package Hub 12 SP1SUSE Package Hub 15 SP1SUSE Package Hub 15 SP2openSUSE Leap 15.1openSUSE Leap 15.2

Fixed in:

4.3.1-bp152.2.5.1

pdns-backend-godbc

SUSE Package Hub 12 SP1SUSE Package Hub 15 SP1SUSE Package Hub 15 SP2openSUSE Leap 15.1openSUSE Leap 15.2

Fixed in:

4.3.1-bp152.2.5.1

pdns-backend-ldap

SUSE Package Hub 12 SP1SUSE Package Hub 15 SP1SUSE Package Hub 15 SP2openSUSE Leap 15.1openSUSE Leap 15.2

Fixed in:

4.3.1-bp152.2.5.1

pdns-backend-lua

SUSE Package Hub 12 SP1SUSE Package Hub 15 SP1SUSE Package Hub 15 SP2openSUSE Leap 15.1openSUSE Leap 15.2

Fixed in:

4.3.1-bp152.2.5.1

pdns-backend-mydns

SUSE Package Hub 12 SP1SUSE Package Hub 15 SP1SUSE Package Hub 15 SP2openSUSE Leap 15.1openSUSE Leap 15.2

Fixed in:

4.1.8-bp151.3.9.2

pdns-backend-mysql

SUSE Package Hub 12 SP1SUSE Package Hub 15 SP1SUSE Package Hub 15 SP2openSUSE Leap 15.1openSUSE Leap 15.2

Fixed in:

4.3.1-bp152.2.5.1

pdns-backend-postgresql

SUSE Package Hub 12 SP1SUSE Package Hub 15 SP1SUSE Package Hub 15 SP2openSUSE Leap 15.1openSUSE Leap 15.2

Fixed in:

4.3.1-bp152.2.5.1

pdns-backend-remote

SUSE Package Hub 12 SP1SUSE Package Hub 15 SP1SUSE Package Hub 15 SP2openSUSE Leap 15.1openSUSE Leap 15.2

Fixed in:

4.3.1-bp152.2.5.1

pdns-backend-sqlite3

SUSE Package Hub 12 SP1SUSE Package Hub 15 SP1SUSE Package Hub 15 SP2openSUSE Leap 15.1openSUSE Leap 15.2

Fixed in:

4.3.1-bp152.2.5.1

References

https://bugzilla.suse.com/1156196

https://bugzilla.suse.com/1176312

https://bugzilla.suse.com/1176535

https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QFEC5JUF7ZEJL5FSPURV27CYZCQG2I2Z/

https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QFEC5JUF7ZEJL5FSPURV27CYZCQG2I2Z/

https://www.suse.com/security/cve/CVE-2020-17482/

https://www.suse.com/support/security/rating/

CVSS Analysis

CVSS v3.1

4.3

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

NoneI:N

Availability

NoneA:N

4.3/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Upstream

Ecosystems

SUSE Package Hub 12 SP1 SUSE Package Hub 15 SP1 SUSE Package Hub 15 SP2 openSUSE Leap 15.1 openSUSE Leap 15.2

Timeline

PublishedSep 27, 2020

ModifiedSep 27, 2020

openSUSE-SU-2020:1556-1 | Mondoo Vulnerability Intelligence