Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 13 Oct 2020 13:13:59 +0200
From: Otto Moerbeek <>
Subject: PowerDNS Recursor 4.3.5, 4.2.5. and 4.1.18 released fixing a cache
 pollution issue (CVE-2020-25829)


Today we are releasing PowerDNS Recursor 4.3.5, 4.2.5. and 4.1.18,
containing a security fix for CVE-2020-25829[1]:

An issue has been found in PowerDNS Recursor where a remote attacker
can cause the cached records for a given name to be updated to the
Bogus DNSSEC validation state, instead of their actual DNSSEC Secure
state, via a DNS ANY query. This results in a denial of service for
installations that always validate (dnssec=validate) and for clients
requesting validation when on-demand validation is enabled
(dnssec=process). The severity is high for these cases.

As usual, there were also other smaller enhancements and
bugfixes. Please refer to the 4.3.5 changelog[2], 4.2.5 changelog[3]
and 4.1.18 changelog[4] for details.

The 4.3.5 tarball[5] (signature[6]), 4.2.5 tarball[7] (signature[8])
and 4.1.18 tarball[9] (signature[10]) are available at our download
site[11] and packages for CentOS 6, 7 and 8, Debian Stretch and
Buster, Ubuntu Xenial and Bionic are available from our

4.0 and older releases are EOL, refer to the documentation[13] for details
about our release cycles.

Please send us all feedback and issues you might have via the mailing
list[14], or in case of a bug, via GitHub[15].


 -Otto and the PowerDNS Team

kind regards,
Otto Moerbeek
Senior PowerDNS Developer


Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.