Homepage

Uncontrolled Recursion The advisory has been revoked - it doesn't affect any version of package pdns-recursor  (opens in a new tab)

Threat Intelligence

EPSS
0.65% (80th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU2010-PDNSRECURSOR-1030019
  • published1 Nov 2020
  • disclosed19 May 2020
Report a new vulnerability Found a mistake?

Introduced: 19 May 2020

CVE-2020-10995  (opens in a new tab)
CWE-674  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:20.10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream pdns-recursor package and not the pdns-recursor package as distributed by Ubuntu.

PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.

References