Description
A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. The issue is due to the fact that the Authoritative Server will exit when it runs into a parsing error while looking up the NS/A/AAAA records it is about to use for an outgoing notify.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PowerDNS | pdns | fixed in 4.1.10, fixed in 4.0.8 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pdns | 4.1.6-3 | — |
| Debian 13 | pdns | 4.1.6-3 | — |
| Debian 12 | pdns | 4.1.6-3 | — |
| Debian 9 | pdns | 4.0.3-1+deb9u5 | DSA-4470-1 |
| Debian 8 | pdns | 3.4.1-4+deb8u10 | DLA-1843-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | pdns | No fix yet | — |
| Ubuntu Pro 16.04 LTS | pdns | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP1 | pdns | 4.1.8-bp151.3.3.1 | openSUSE-SU-2019:1921-1 |
| SUSE Package Hub 15 | pdns | 4.1.2-bp150.2.9.1 | openSUSE-SU-2019:1904-1 |
| SUSE Package Hub 12 SP1 | pdns | 4.1.2-bp150.2.9.1 | openSUSE-SU-2019:1904-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pdns | 4.5.1-1.5 | openSUSE-SU-2024:11156-1 |
| openSUSE Leap 15.1 | pdns | 4.1.2-bp150.2.9.1 | openSUSE-SU-2019:1904-1 |
| openSUSE Leap 15.0 | pdns | 4.1.2-bp150.2.9.1 | openSUSE-SU-2019:1904-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | pdns | 4.1.10-r0 | — |
| Alpine v3.23 | pdns | 4.1.10-r0 | — |
| Alpine v3.22 | pdns | 4.1.10-r0 | — |
| Alpine v3.21 | pdns | 4.1.10-r0 | — |
| Alpine v3.20 | pdns | 4.1.10-r0 | — |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | pdns | 4.1.10-r0 | — |
| Alpine v3.18 | pdns | 4.1.10-r0 | — |
| Alpine v3.17 | pdns | 4.1.10-r0 | — |
| Alpine v3.16 | pdns | 4.1.10-r0 | — |
| Alpine v3.15 | pdns | 4.1.10-r0 | — |
| Alpine v3.14 | pdns | 4.1.10-r0 | — |
| Alpine v3.13 | pdns | 4.1.10-r0 | — |
| Alpine v3.12 | pdns | 4.1.10-r0 | — |
| Alpine v3.11 | pdns | 4.1.10-r0 | — |
| Alpine v3.10 | pdns | 4.1.10-r0 | — |
| Alpine v3.9 | pdns | 4.1.10-r0 | — |
| Alpine v3.8 | pdns | 4.1.10-r0 | — |
| Alpine v3.7 | pdns | 4.0.8-r0 | — |
Advisories 5
- DSA-4470-1 pdns - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1843-1 pdns - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2019:1921-1 Security update for pdns SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11156-1 pdns-4.5.1-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1904-1 Security update for pdns SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10162
- https://blog.powerdns.com/2019/06/21/powerdns-authoritative-server-4-0-8-and-4-1-10-released/
- https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-04.html
- openSUSE-SU-2019:1904 vendor-advisory
- openSUSE-SU-2019:1921 vendor-advisory