CVE-2018-14626
First published: Thu Nov 29 2018(Updated: )
Last updated 14 January 2025
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/pdns | 4.4.1-1 4.7.3-2 4.9.3-1 | |
| debian/pdns-recursor | 4.4.2-3 4.8.8-1 5.1.3-1 | |
| PowerDNS | >=4.1.0<=4.1.4 | |
| PowerDNS | >=4.0.0<=4.1.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14626
- https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2018-05.html
- https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-06.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14626
- https://nvd.nist.gov/vuln/detail/CVE-2018-14626
- https://launchpad.net/bugs/cve/CVE-2018-14626
- https://security-tracker.debian.org/tracker/CVE-2018-14626
- https://ubuntu.com/security/CVE-2018-14626
- https://downloads.powerdns.com/patches/2018-05/
- https://downloads.powerdns.com/patches/2018-06/
Frequently Asked Questions
What is CVE-2018-14626?
CVE-2018-14626 is a vulnerability in PowerDNS Authoritative Server and PowerDNS Recursor that allows packet cache pollution via a crafted query, leading to denial of service.
Which PowerDNS software versions are affected?
PowerDNS Authoritative Server versions 4.1.0 to 4.1.4 and PowerDNS Recursor versions 4.0.0 to 4.1.4 are affected.
What is the severity of CVE-2018-14626?
CVE-2018-14626 has a severity rating of high with a CVSS score of 7.5.
How can the vulnerability be exploited?
The vulnerability can be exploited by sending a crafted query to the vulnerable PowerDNS server, polluting the packet cache and causing denial of service.
Are there any patches or fixes available?
Yes, PowerDNS has released security advisories for both the PowerDNS Authoritative Server and PowerDNS Recursor, providing patches to address the vulnerability.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/first-publish-date
- collector/usn-cve
- source/Ubuntu
- agent/description
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/references
- collector/launchpad-cve
- source/Launchpad
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/author
- agent/source
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/debian
- vendor/powerdns
- canonical/powerdns
- version/powerdns/4.1.0
- version/powerdns/4.1.4
- version/powerdns/4.0.0