CVE-2024-25583 Crafted responses can lead to a denial of service in Recursor if recursive forwarding is configured
Attackers can cause denial of service in PowerDNS Recursor via crafted upstream responses when recursive forwarding is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-25583?
CVE-2024-25583 is a high-severity denial of service vulnerability in PowerDNS Recursor, published on 25 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected.
Weakness: CWE-20
Which versions are affected by CVE-2024-25583?
Linux distribution packages (3)
pdns-recursor SUSE:Package Hub 15 SP5 | All versions | 4.8.8-bp155.2.6.1 |
pdns-recursor openSUSE:Leap 15.5 | All versions | 4.8.8-bp155.2.6.1 |
pdns-recursor openSUSE:Tumbleweed | All versions | 5.0.4-1.1 |
How do I fix CVE-2024-25583?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-25583 being exploited?
There is no known exploitation of CVE-2024-25583 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-25583, DSA-5674-1, GHSA-rx5p-gx7r-2xj5, UBUNTU-CVE-2024-25583, openSUSE-SU-2024:0114-1, openSUSE-SU-2024:13901-1.