FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

powerdns-recursor -- access restriction bypass

Affected packages
4.3.0 <= powerdns-recursor < 4.3.2
4.2.0 <= powerdns-recursor < 4.2.3
4.1.0 <= powerdns-recursor < 4.1.17


VuXML ID 641cd669-bc37-11ea-babf-6805ca2fa271
Discovery 2020-07-01
Entry 2020-07-02

PowerDNS Team reports:

CVE-2020-14196: An issue has been found in PowerDNS Recursor where the ACL applied to the internal web server via webserver-allow-from is not properly enforced, allowing a remote attacker to send HTTP queries to the internal web server, bypassing the restriction. In the default configuration the API webserver is not enabled. Only installations using a non-default value for webserver and webserver-address are affected.


CVE Name CVE-2020-14196