CVE-2019-3807 Security feature bypass in pdns-recursor
Attackers can bypass DNSSEC validation in PowerDNS Recursor by exploiting improper validation of authoritative server responses.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-3807?
CVE-2019-3807 is a low-severity vulnerability in Powerdns Recursor, published on 29 Jan 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation.
Which versions are affected by CVE-2019-3807?
It affects 1 product.
Linux distribution packages (1)
pdns-recursor SUSE:Package Hub 15 | All versions | 4.1.2-bp150.2.6.1 |
Products include Powerdns Recursor.
How do I fix CVE-2019-3807?
Upgrade to a fixed version.
Is CVE-2019-3807 being exploited?
There is no known exploitation of CVE-2019-3807 in the wild and no public exploit code.
Other vulnerabilities in Powerdns Recursor
- CVE-2009-4009 Memory corruption in n/a
- CVE-2020-10030 Memory corruption in n/a
- CVE-2025-59023 Crafted delegations or IP fragments can poison cached delegations in Recursor
- CVE-2025-59030 Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor
- CVE-2023-22617 Denial of service in n/a
Sources
Also known as DEBIAN-CVE-2019-3807, GHSA-3h27-2wg2-w59m, UBUNTU-CVE-2019-3807, openSUSE-SU-2019:0100-1, openSUSE-SU-2019:0107-1.