FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

powerdns-recursor -- access restriction bypass

Affected packages
4.3.0	<=	powerdns-recursor	<	4.3.2
4.2.0	<=	powerdns-recursor	<	4.2.3
4.1.0	<=	powerdns-recursor	<	4.1.17

Details

VuXML ID	641cd669-bc37-11ea-babf-6805ca2fa271
Discovery	2020-07-01
Entry	2020-07-02

PowerDNS Team reports:

CVE-2020-14196: An issue has been found in PowerDNS Recursor where the ACL applied to the internal web server via webserver-allow-from is not properly enforced, allowing a remote attacker to send HTTP queries to the internal web server, bypassing the restriction. In the default configuration the API webserver is not enabled. Only installations using a non-default value for webserver and webserver-address are affected.

[source]

References

CVE Name	CVE-2020-14196
URL	https://doc.powerdns.com/recursor/security-advisories/index.html