CVE-2022-37428: Medium severity powerdns vulnerability
Published Aug 23, 2022
·Updated
PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception, leading to a denial of service (daemon crash) via a DNS query that leads to an answer with specific properties.
Affected Software
4 affected components
PowerDNS recursor>=4.5.0<4.5.10
PowerDNS recursor>=4.6.0<4.6.3
PowerDNS recursor>=4.7.0<4.7.2
Fedoraproject Fedora=36
Event History
Aug 23, 2022
CVE Published
via MITRE·04:33 PM
Data Sourced
via MITRE·04:33 PM
DescriptionSeverity
Frequently Asked Questions
1
What is the vulnerability ID for this PowerDNS vulnerability?
The vulnerability ID for this PowerDNS vulnerability is CVE-2022-37428.
2
What is the severity of CVE-2022-37428?
The severity of CVE-2022-37428 is medium.
3
Which versions of PowerDNS Recursor are affected by CVE-2022-37428?
PowerDNS Recursor up to and including versions 4.5.9, 4.6.2, and 4.7.1 are affected by CVE-2022-37428.
4
How does protobuf logging enable the vulnerability in PowerDNS Recursor?
Protobuf logging enables the vulnerability in PowerDNS Recursor by causing improper cleanup upon a thrown exception.
5
How can I fix CVE-2022-37428 in PowerDNS Recursor?
To fix CVE-2022-37428 in PowerDNS Recursor, update to version 4.5.10, 4.6.3, or 4.7.2, depending on your current version.