Critical Security Update for pdns-recursor: DSA-5852-1
Summary
DSA-5852-1: pdns-recursor - security update. Affects pdns-recursor versions < 4.8.8-1+deb12u1. Fixed in 4.8.8-1+deb12u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pdns-recursor is a high-performance DNS resolver that is widely used in various network environments. It is designed to handle large volumes of DNS queries efficiently, providing features such as DNSSEC support, DNS over HTTPS, and advanced caching mechanisms. The package is crucial for ensuring reliable and secure DNS resolution, but it is susceptible to vulnerabilities that can compromise its integrity and security.
Vulnerability Detail
The vulnerability identified as CVE-2024-25590 affects pdns-recursor, allowing an attacker to exploit a flaw in the DNS resolution process. This could lead to unauthorized access or manipulation of DNS queries, potentially redirecting users to malicious sites or disrupting service. The issue originates from improper handling of certain DNS requests, which can be leveraged by attackers to execute arbitrary code or cause denial of service.
How To Fix
Minimum fixed version
4.8.8-1+deb12u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pdns-recursorTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the pdns-recursor service by configuring firewall rules to limit incoming connections only to trusted IP addresses. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The pdns-recursor package has a critical vulnerability (CVE-2024-25590) that requires immediate attention. Users are advised to update to the patched version to ensure the security and integrity of their DNS resolution services. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for pdns-recursor →
FAQ
The impact includes potential unauthorized access to DNS queries, which can lead to data breaches or service disruptions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If immediate updates are not possible, implement firewall rules to restrict access to the pdns-recursor service as a temporary workaround.
More information can be found in the official Debian security advisory DSA-5852-1 and the CVE database.
Related vulnerabilities
Recent vulnerabilities recorded for pdns-recursor.
