Vulnerability in Powerdns
CVE-2017-15090
An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter the content of records by issuing a valid signature for the crafted records.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.007 (51.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 52nd percentile — 51.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.007 · change: +0.001
Affected products
- Powerdns — versions from 4.0.0 and up to and including 4.0.6
- Powerdns Recursor
Weakness classification (CWE)
References
- doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2017-03.html (Patch, Vendor Advisory)
- www.securityfocus.com/bid/101982 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2017-15090?
- CVE-2017-15090 is a medium-severity vulnerability in Powerdns, classified under Improper Verification of Cryptographic Signature. CVSS score: 5.9/10. Published 2018-01-23.
- How severe is CVE-2017-15090?
- Medium severity. CVSS v3 base score is 5.9 out of 10.