CVE-2020-14196
First published: Wed Jul 01 2020(Updated: )
In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PowerDNS Recursor | <=4.1.16 | |
| PowerDNS Recursor | >=4.2.0<=4.2.2 | |
| PowerDNS Recursor | >=4.3.0<=4.3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00043.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00042.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00044.html
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00036.html
- https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-04.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7TUNCUZNASYSTVD35QGFAI6XO2BFMQ2F/
- https://www.openwall.com/lists/oss-security/2020/07/01/1
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7TUNCUZNASYSTVD35QGFAI6XO2BFMQ2F/
Frequently Asked Questions
What is CVE-2020-14196?
CVE-2020-14196 is a vulnerability in PowerDNS Recursor versions up to and including 4.3.1, 4.2.2, and 4.1.16 that allows unauthorized access to the internal web server.
How severe is CVE-2020-14196?
CVE-2020-14196 has a severity score of 5.3 which is considered medium.
What is the affected software for CVE-2020-14196?
The affected software for CVE-2020-14196 is PowerDNS Recursor versions up to and including 4.3.1, 4.2.2, and 4.1.16.
How can the ACL restricting access to the internal web server be enforced in PowerDNS Recursor?
To enforce the ACL restricting access to the internal web server in PowerDNS Recursor, it is recommended to upgrade to a version higher than 4.3.1, 4.2.2, and 4.1.16.
Where can I find more information about CVE-2020-14196?
You can find more information about CVE-2020-14196 at the following references: [Link 1](http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00043.html), [Link 2](http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00042.html), [Link 3](http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00044.html)
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/author
- agent/severity
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- vendor/powerdns
- canonical/powerdns recursor
- version/powerdns recursor/4.1.16
- version/powerdns recursor/4.2.0
- version/powerdns recursor/4.2.2
- version/powerdns recursor/4.3.0
- version/powerdns recursor/4.3.1