CVE-2020-17482 Information disclosure in n/a
Authorized users can leak uninitialized memory content by inserting crafted records into a zone in PowerDNS Authoritative Server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-17482?
CVE-2020-17482 is a medium-severity vulnerability in n/a, published on 2 Oct 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue has been found in PowerDNS Authoritative Server before 4.3.1 where an authorized user with the ability to insert crafted records into a zone might be able to leak the content of uninitialized memory.
Weakness: CWE-908
Which versions are affected by CVE-2020-17482?
It affects 1 product.
Linux distribution packages (8)
pdns SUSE:HPE Helion OpenStack 8 | All versions | 4.1.2-3.9.1 |
pdns SUSE:OpenStack Cloud 8 | All versions | 4.1.2-3.9.1 |
pdns SUSE:OpenStack Cloud 9 | All versions | 4.1.8-3.6.1 |
pdns SUSE:Package Hub 12 SP1 | All versions | 4.3.1-bp152.2.5.1 |
pdns SUSE:Package Hub 15 SP1 | All versions | 4.3.1-bp152.2.5.1 |
pdns SUSE:Package Hub 15 SP2 | All versions | 4.3.1-bp152.2.5.1 |
pdns openSUSE:Leap 15.1 | All versions | 4.3.1-bp152.2.5.1 |
pdns openSUSE:Leap 15.2 | All versions | 4.3.1-bp152.2.5.1 |
Products include Powerdns Authoritative.
How do I fix CVE-2020-17482?
Upgrade to a fixed version.
Is CVE-2020-17482 being exploited?
There is no known exploitation of CVE-2020-17482 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2020-17482, GHSA-rwvv-h93r-mw45, SUSE-SU-2020:2718-1, SUSE-SU-2020:2785-1, UBUNTU-CVE-2020-17482, openSUSE-SU-2020:1556-1.