Vulnerability in Powerdns
CVE-2017-15090
An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter the content of records by issuing a valid signature for the crafted records.
EPSS: 0.006 (45.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Powerdns — versions from 4.0.0 and up to and including 4.0.6
- Powerdns Recursor
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2017-15090?
- CVE-2017-15090 is a medium-severity vulnerability in Powerdns, classified under Improper Verification of Cryptographic Signature. CVSS score: 5.9/10. Published 2018-01-23.
- How severe is CVE-2017-15090?
- Medium severity. CVSS v3 base score is 5.9 out of 10.