PowerDNS Recursor 4.3.2, 4.2.3. and 4.1.17 released fixing CVE-2020-14196: Access restriction, bypass

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============8355081955902526160==
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="hDdYCQr17SsPnpRYn1lIemd21Y5uN919r"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--hDdYCQr17SsPnpRYn1lIemd21Y5uN919r
Content-Type: multipart/mixed; boundary="lLyos9JysMya7JukCP0nmDSBEU0uU12SL"

--lLyos9JysMya7JukCP0nmDSBEU0uU12SL
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

Hello!,

Today we are releasing PowerDNS Recursor 4.3.2, 4.2.3. and 4.1.17,
containing a security fix for CVE-2020-14196: Access restriction
bypass[0].

An issue has been found in PowerDNS Recursor where the ACL applied to
the internal web server via `webserver-allow-from` is not properly
enforced, allowing a remote attacker to send HTTP queries to the
internal web server, bypassing the restriction.

Note that the web server is not enabled by default. Only installations
using a non-default value for `webserver` and `webserver-address` are
affected.

Workarounds are: disable the webserver or set a password or an API
key. Additionally, restrict the binding address using the
`webserver-address` setting to local addresses only and/or use a
firewall to disallow web requests from untrusted sources reaching the
webserver listening address.

As usual, there were also other smaller enhancements and bugfixes. In
particular, the 4.3.2 release contains fixes that allow long CNAME
chains to resolve properly, where previously they could fail if qname
minimization is enabled.  Please refer to the 4.3.2 changelog[1],
4.2.3 changelog[2] and 4.1.17 changelog[3] for details.

The 4.3.2 tarball[4] (signature[5]), 4.2.3 tarball[6] (signature[7])
and 4.1.17 tarball[8] (signature[9]) are available from our download
site[10] and packages for CentOS 6, 7 and 8, Debian Stretch and
Buster, Ubuntu Xenial and Bionic are available from our
repository[11].

4.0 and older releases are EOL, refer to the documentation[12] for
details about our release cycles.

Please send us all feedback and issues you might have via the mailing
list[13], or in case of a bug, via GitHub[14].

[0] https://docs.powerdns.com/recursor/security-advisories/powerdns-advis=
ory-2020-04.html
[1] https://doc.powerdns.com/recursor/changelog/4.3.html#change-4.3.2
[2] https://doc.powerdns.com/recursor/changelog/4.2.html#change-4.2.3
[3] https://doc.powerdns.com/recursor/changelog/4.1.html#change-4.1.17
[4] https://downloads.powerdns.com/releases/pdns-recursor-4.3.2.tar.bz2
[5] https://downloads.powerdns.com/releases/pdns-recursor-4.3.2.tar.bz2.s=
ig
[6] https://downloads.powerdns.com/releases/pdns-recursor-4.2.3.tar.bz2
[7] https://downloads.powerdns.com/releases/pdns-recursor-4.2.3.tar.bz2.s=
ig
[8] https://downloads.powerdns.com/releases/pdns-recursor-4.1.17.tar.bz2
[9] https://downloads.powerdns.com/releases/pdns-recursor-4.1.17.tar.bz2.=
sig
[10] https://downloads.powerdns.com/releases/
[11] https://repo.powerdns.com/
[12] https://docs.powerdns.com/recursor/appendices/EOL.html
[13] https://mailman.powerdns.com/mailman/listinfo/pdns-users
[14] https://github.com/PowerDNS/pdns/issues/new/choose

Regards,=20

  Otto and the PowerDNS team

--=20
Otto Moerbeek
Senior PowerDNS Developer

Email: [email protected]




--lLyos9JysMya7JukCP0nmDSBEU0uU12SL--

--hDdYCQr17SsPnpRYn1lIemd21Y5uN919r
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEmQw9Dqx8J13GsYQ26sq5Cxlj7CsFAl78fLgACgkQ6sq5Cxlj
7Csy7wf/Rpddx2K8uLv8b1xSMuO1GxfEoBAdWtdvLxwG3veYxUNuk2BdAPPwonKX
XFPz3+qwskizNXt5fMoCOHx5iPPfmZHba25qCaL0gScl0Sn4wWbEVxScHUdMg81R
zGBhUabfzbcV5AS+LxhYXiRHyo97jMnFhVZzrHRs/FZKStVbYPt37Djkxc0C7Ujf
H3dTIRj+f0jMH4CadQlzrxQGPkJsAMM6Dtl/a+bRBVG+/icU4ANJIu7s1p19GD84
9mX44sPF6ZOijlrFG3616QYhF+tnTUYt9FWxIFvYwlE04Xuou08gkJTxhpOHgvsX
DEMn6jqk6zdrD9cqa4D7RkXo3w3ZSg==
=48gl
-----END PGP SIGNATURE-----

--hDdYCQr17SsPnpRYn1lIemd21Y5uN919r--

--===============8355081955902526160==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Pdns-dev mailing list
[email protected]
https://mailman.powerdns.com/mailman/listinfo/pdns-dev

--===============8355081955902526160==--