PowerDNS Recursor 4.3.1, 4.2.2. and 4.1.16 released fixing multiple vulnerabilities

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============7251268509041916803==
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="WAFDXM2Ma4LjI3mxivbXBCts8emcRV7J2"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--WAFDXM2Ma4LjI3mxivbXBCts8emcRV7J2
Content-Type: multipart/mixed; boundary="AObrR3G6YlCQo6EdmC7ILCnivqY2KKlE6"

--AObrR3G6YlCQo6EdmC7ILCnivqY2KKlE6
Content-Type: text/plain; charset=utf-8
Content-Language: en-GB
Content-Transfer-Encoding: quoted-printable

Hello!,

Today we are releasing PowerDNS Recursor 4.3.1, 4.2.2. and 4.1.16,
containing security fixes for three CVEs:

- CVE-2020-10995[1]
- CVE-2020-12244[2]
- CVE-2020-10030[3]

The issues are:

CVE-2020-10995: An issue in the DNS protocol has been found that allows
malicious parties to use recursive DNS services to attack third party
authoritative name servers. Severity is medium. We would like to thank
Lior Shafir, Yehuda Afek and Anat Bremler-Barr for finding and
subsequently reporting this issue!

CVE-2020-12244: Records in the answer section of a NXDOMAIN response
lacking an SOA were not properly validated. Severity is medium. We would
like to thank Matt Nordhoff for finding and subsequently reporting this
issue!

CVE-2020-10030: An attacker with enough privileges to change the
hostname might be able to disclose uninitialized memory. This issue also
affects the Authoritative Server and dnsdist; since the attack requires
very high privileges and the issue does not affect Linux, we will not be
releasing new versions for those just for this issue. Severity is low.

As usual, there were also other smaller enhancements and bugfixes.
Please refer to the 4.3.1 changelog[4], 4.2.2 changelog[5] and 4.1.16
changelog[6] for details.

The 4.3.1 tarball[7] (signature[8]), 4.2.2 tarball[9] (signature[10])
and 4.1.16 tarball[11] (signature[12]) are available at our download
site[13] and packages for CentOS 6, 7 and 8, Debian Stretch and Buster,
Ubuntu Xenial and Bionic are available from our repository[14]

Note that the 4.1 packages will be published later today.

4.0 and older releases are EOL, refer to the documentation[15] for
details about our release cycles.

Please send us all feedback and issues you might have via the mailing
list[16], or in case of a bug, via GitHub[17].


[1]
https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-=
2020-01.html
[2]
https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-=
2020-02.html
[3]
https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-=
2020-03.html
[4] https://doc.powerdns.com/recursor/changelog/4.3.html#change-4.3.1
[5] https://doc.powerdns.com/recursor/changelog/4.2.html#change-4.2.2
[6] https://doc.powerdns.com/recursor/changelog/4.1.html#change-4.1.16
[7] https://downloads.powerdns.com/releases/pdns-recursor-4.3.1.tar.bz2
[8] https://downloads.powerdns.com/releases/pdns-recursor-4.3.1.tar.bz2.s=
ig
[9] https://downloads.powerdns.com/releases/pdns-recursor-4.2.2.tar.bz2
[10] https://downloads.powerdns.com/releases/pdns-recursor-4.2.2.tar.bz2.=
sig
[11] https://downloads.powerdns.com/releases/pdns-recursor-4.1.16.tar.bz2=

[12]
https://downloads.powerdns.com/releases/pdns-recursor-4.1.16.tar.bz2.sig
[13] https://downloads.powerdns.com/releases
[14] https://repo.powerdns.com/
[15] https://docs.powerdns.com/recursor/appendices/EOL.html
[16] https://mailman.powerdns.com/mailman/listinfo/pdns-users
[17] https://github.com/PowerDNS/pdns/issues/new/choose

--=20
kind regards,
Otto Moerbeek
Senior PowerDNS Developer

Email: [email protected]


--AObrR3G6YlCQo6EdmC7ILCnivqY2KKlE6--

--WAFDXM2Ma4LjI3mxivbXBCts8emcRV7J2
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEmQw9Dqx8J13GsYQ26sq5Cxlj7CsFAl7Dn5oACgkQ6sq5Cxlj
7CvpHQf/T4sE4oEELFTGp6ZIfLqenY24SrUtD5GT4KDa0Qv2yrwJ3XRTIj8C66H0
7qgK066zNVhje+uhuRggfaIEwSBY6r6M4D7ZzoawtXvJgDjYYUG7k6JUd6DYU+WL
ANCfJ2VUj5Ic6y8nhXayDfqI0gM9DqEuIUEB4lHfztvDtnIrwTkMg4fXRdEwfTyb
0wF2mT7hHCD8gVMhoEeSsRquZTIzqJxD8jUiGdArT6e+OQ2vZ8RPzWWbcZ+ych6Z
TA1dwC7fOpH4w+kcYblqV2WSwTo+iBMH2+FSpgl9APlyYLuYBZnLjiK1dn8f2TML
Epp0iL0s+Bj38oR/uro/HxTbJJa03w==
=k61H
-----END PGP SIGNATURE-----

--WAFDXM2Ma4LjI3mxivbXBCts8emcRV7J2--

--===============7251268509041916803==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Pdns-dev mailing list
[email protected]
https://mailman.powerdns.com/mailman/listinfo/pdns-dev

--===============7251268509041916803==--