Vulnerability Details CVE-2022-37428
PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception, leading to a denial of service (daemon crash) via a DNS query that leads to an answer with specific properties.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 10.4%
CVSS Severity
CVSS v3 Score 6.5
References
- https://docs.powerdns.com/recursor/lua-config/protobuf.html
- https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-02.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FXSREJKTT6RNE3GXQENQ4R4HS37UNSPX/
- https://docs.powerdns.com/recursor/lua-config/protobuf.html
- https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-02.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FXSREJKTT6RNE3GXQENQ4R4HS37UNSPX/
Products affected by CVE-2022-37428
-
cpe:2.3:a:powerdns:recursor:4.5.0
-
cpe:2.3:a:powerdns:recursor:4.5.1
-
cpe:2.3:a:powerdns:recursor:4.5.2
-
cpe:2.3:a:powerdns:recursor:4.5.4
-
cpe:2.3:a:powerdns:recursor:4.5.5
-
cpe:2.3:a:powerdns:recursor:4.5.6
-
cpe:2.3:a:powerdns:recursor:4.5.7
-
cpe:2.3:a:powerdns:recursor:4.5.8
-
cpe:2.3:a:powerdns:recursor:4.5.9
-
cpe:2.3:a:powerdns:recursor:4.6.0
-
cpe:2.3:a:powerdns:recursor:4.6.1
-
cpe:2.3:a:powerdns:recursor:4.6.2
-
cpe:2.3:a:powerdns:recursor:4.7.0
-
cpe:2.3:a:powerdns:recursor:4.7.1
-
cpe:2.3:o:fedoraproject:fedora:36