Description
PowerDNS Authoritative Server before 2.9.21.1 drops malformed queries, which might make it easier for remote attackers to poison DNS caches of other products running on other servers, a different issue than CVE-2008-1447 and CVE-2008-3217.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pdns | 2.9.21.1-1 | — |
| Debian 13 | pdns | 2.9.21.1-1 | — |
| Debian 12 | pdns | 2.9.21.1-1 | — |
| Debian 4.0 | pdns | 2.9.20-8+etch1 | DSA-1628-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pdns | 4.5.1-1.5 | openSUSE-SU-2024:11156-1 |
Advisories 2
- DSA-1628-1 pdns - DNS spoofing Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11156-1 pdns-4.5.1-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- SUSE-SR:2008:017 vendor-advisory
- FEDORA-2008-7048 vendor-advisory
- 31401 third-party-advisory
- 30587 vdb-entry
- 31687 third-party-advisory
- http://doc.powerdns.com/changelog.html
- 31448 third-party-advisory
- DSA-1628 vendor-advisory
- http://doc.powerdns.com/powerdns-advisory-2008-02.html
- 33264 third-party-advisory
- FEDORA-2008-7083 vendor-advisory
- [pdns-users] 20080806 Security update: PowerDNS Authoritative Server 2.9.21.1 released mailing-list
- powerdns-query-weak-security(44253) vdb-entry
- GLSA-200812-19 vendor-advisory
- 31407 third-party-advisory
- ADV-2008-2320 vdb-entry