CVE-2023-22617

CVSS V2 None CVSS V3 None

Description

A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS records for a misconfigured domain, because QName minimization is used in QM fallback mode. This is fixed in 4.8.1.

Overview

CVE ID
CVE-2023-22617

Assigner
cve@mitre.org

Vulnerability Status
Analyzed

Published Version
2023-01-21T19:15:11

Last Modified Date
2023-01-31T17:24:14

Weakness Enumerations

CWE	URL
CWE-674	http://cwe.mitre.org/data/definitions/674.html

CPE Configuration (Product)

CPE	Vulnerable	Operator	Version Start	Version End
cpe:2.3:a:powerdns:recursor:4.8.0:::::::*	1	OR

References

Reference URL	Reference Tags
http://www.openwall.com/lists/oss-security/2023/01/20/1
https://docs.powerdns.com/recursor/changelog/4.8.html#change-4.8.1
https://docs.powerdns.com/recursor/security-advisories/

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-22617
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22617

History

Created	Old Value	New Value	Data Type	Notes
2023-01-21 20:13:30				Added to TrackCVE
2023-01-23 15:14:32		2023-01-23T15:08:08	CVE Modified Date	updated
2023-01-23 15:14:32	Received	Awaiting Analysis	Vulnerability Status	updated
2023-01-27 20:15:19	Awaiting Analysis	Undergoing Analysis	Vulnerability Status	updated
2023-01-31 18:13:11		2023-01-31T17:24:14	CVE Modified Date	updated
2023-01-31 18:13:11	Undergoing Analysis	Analyzed	Vulnerability Status	updated
2023-01-31 18:13:12			Weakness Enumeration	new
2023-01-31 18:13:13			CPE Information	updated