Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2020-17482: PowerDNS Authoritative Server may expose memory contents
CVE-2020-17482 · published 6 years ago
Summary
A user who can add specially crafted DNS records to PowerDNS Authoritative Server (versions before 4.3.1) can cause the server to reveal leftover data from its memory. This could unintentionally leak information that was previously stored in the system. Upgrade the server to version 4.3.1 or later and limit record‑insertion rights to trusted personnel.
What to do
- Update debian pdns to version 4.3.1-1.
- Update powerdns authoritative to version 4.3.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | pdns |
< 4.3.1-1 Fix: upgrade to 4.3.1-1
|
| Debian:13 | debian | pdns |
< 4.3.1-1 Fix: upgrade to 4.3.1-1
|
| Debian:14 | debian | pdns |
< 4.3.1-1 Fix: upgrade to 4.3.1-1
|
| – | powerdns | authoritative |
< 4.3.1 cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:* |
Original advisory text
An issue has been found in PowerDNS Authoritative Server before 4.3.1 where an authorized user with the ability to insert crafted records into a zone might be able to leak the content of uninitiali...
An issue has been found in PowerDNS Authoritative Server before 4.3.1 where an authorized user with the ability to insert crafted records into a zone might be able to leak the content of uninitialized memory.
References
- https://security-tracker.debian.org/tracker/CVE-2020-17482 Vendor Advisory
- https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-202... Vendor Advisory
- https://github.com/PowerDNS/pdns Third Party Advisory
- https://security.gentoo.org/glsa/202012-18 Third Party Advisory
Severity
4.3
Medium
Type
CWE-908Use of Uninitialized Resource
Timeline
Published2 Oct 2020
Updated29 Oct 2026
First seen11 Sep 2026
Track software like this
Free during beta