CVE-2019-10162 Denial of service in pdns

What is CVE-2019-10162?

CVE-2019-10162 is a low-severity denial of service vulnerability in Opensuse Leap, published on 30 Jul 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. The issue is due to the fact that the Authoritative Server will exit when it runs into a parsing error while looking up the NS/A/AAAA records it is about to use for an outgoing notify.

Weakness: CWE-400

Which versions are affected by CVE-2019-10162?

It affects 2 products.

Products include Opensuse Leap, Powerdns Authoritative.

How do I fix CVE-2019-10162?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-10162 being exploited?

There is no known exploitation of CVE-2019-10162 in the wild and no public exploit code.

Other vulnerabilities in Opensuse Leap

• CVE-2015-4902 Oracle Java SE Integrity Check Exploited Medium 5.3
• CVE-2017-14804 package builds could use directory traversal to write outside of target area Critical 9.9
• CVE-2019-20787 Teeworlds before 0.7.4 has an integer overflow when computing a tilemap size. Critical 9.8
• CVE-2019-8341 Code injection in n/a Critical 9.8
• CVE-2019-6438 Other in n/a Critical 9.8

All Opensuse Leap vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-10162, GHSA-66xg-v84p-j4x5, UBUNTU-CVE-2019-10162.