Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 866219 (CVE-2022-37428) - <net-dns/pdns-recursor-3.7.2: DoS when protobuf logging is enabled
Summary: <net-dns/pdns-recursor-3.7.2: DoS when protobuf logging is enabled
Status: IN_PROGRESS
Alias: CVE-2022-37428
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://docs.powerdns.com/recursor/se...
Whiteboard: B3 [glsa?]
Keywords:
Depends on:
Blocks:
 
Reported: 2022-08-23 19:26 UTC by John Helmert III
Modified: 2022-08-24 17:37 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-08-23 19:26:22 UTC 
CVE-2022-37428:

PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception, leading to a denial of service (daemon crash) via a DNS query that leads to an answer with specific properties.

Please bump to 4.7.2.
Comment 1 Larry the Git Cow gentoo-dev 2022-08-23 20:49:31 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8fbf54bc21dd4b5c777be76a031350782ced07e8

commit 8fbf54bc21dd4b5c777be76a031350782ced07e8
Author:     Sven Wegener <swegener@gentoo.org>
AuthorDate: 2022-08-23 20:37:55 +0000
Commit:     Sven Wegener <swegener@gentoo.org>
CommitDate: 2022-08-23 20:49:24 +0000

    net-dns/pdns-recursor: Version bump, security bug #866219
    
    Bug: https://bugs.gentoo.org/866219
    Package-Manager: Portage-3.0.30, Repoman-3.0.3
    Signed-off-by: Sven Wegener <swegener@gentoo.org>

 net-dns/pdns-recursor/Manifest                   |  1 +
 net-dns/pdns-recursor/pdns-recursor-4.7.2.ebuild | 88 ++++++++++++++++++++++++
 2 files changed, 89 insertions(+)
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-08-23 20:51:52 UTC 
Thanks! Please stabilize when ready.
Comment 3 Larry the Git Cow gentoo-dev 2022-08-23 21:07:58 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e19ba0ba9fb02db215a2c923716fa358dd618ff0

commit e19ba0ba9fb02db215a2c923716fa358dd618ff0
Author:     Sven Wegener <swegener@gentoo.org>
AuthorDate: 2022-08-23 21:04:47 +0000
Commit:     Sven Wegener <swegener@gentoo.org>
CommitDate: 2022-08-23 21:05:02 +0000

    net-dns/pdns-recursor: Stabilize 4.7.2 on amd64/x86, sec. bug #866219
    
    Bug: https://bugs.gentoo.org/866219
    Package-Manager: Portage-3.0.30, Repoman-3.0.3
    Signed-off-by: Sven Wegener <swegener@gentoo.org>

 net-dns/pdns-recursor/pdns-recursor-4.7.2.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 4 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-08-23 21:10:03 UTC 
Thanks! Please cleanup.
Comment 5 Larry the Git Cow gentoo-dev 2022-08-24 16:36:48 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=624fc1897cd287ccce57884edf8d3b8391bcc1f6

commit 624fc1897cd287ccce57884edf8d3b8391bcc1f6
Author:     Sven Wegener <swegener@gentoo.org>
AuthorDate: 2022-08-24 16:35:26 +0000
Commit:     Sven Wegener <swegener@gentoo.org>
CommitDate: 2022-08-24 16:36:41 +0000

    net-dns/pdns-recursor: Cleanup
    
    Bug: https://bugs.gentoo.org/866219
    Package-Manager: Portage-3.0.30, Repoman-3.0.3
    Signed-off-by: Sven Wegener <swegener@gentoo.org>

 net-dns/pdns-recursor/Manifest                   |  1 -
 net-dns/pdns-recursor/pdns-recursor-4.7.1.ebuild | 88 ------------------------
 2 files changed, 89 deletions(-)