CVE-2018-10851

PowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.1.5 and 4.0.6, and PowerDNS Recursor 3.2 up to 4.1.4 excluding 4.1.5 and 4.0.9, are vulnerable to a memory leak while parsing malformed records that can lead to remote denial of service.

A vulnerability was in found in PowerDNS Authoritative Server. The issue is a memory leak occurring while parsing some malformed records, due to the fact that some memory is allocated parsing a record and is not always properly released if the record is not valid. It allows an authorized user to cause a denial of service by inserting specially crafted records in a zone under their control, then sending DNS queries for that zone (CVE-2018-10851).

An issue has been found in PowerDNS Authoritative Server allowing a remote user to craft a DNS query that will cause an answer without DNSSEC records to be inserted into the packet cache and be returned to clients asking for DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname and qtype. For a DNSSEC-signed domain, this means that DNSSEC validating clients will consider the answer to be bogus until it expires from the packet cache, leading to a denial of service (CVE-2018-14626).

A vulnerability was in found in PowerDNS Recursor. The issue is a memory leak occurring while parsing some malformed records, due to the fact that some memory is allocated parsing a record and is not always properly released if the record is not valid. It allows a malicious auth server to cause a denial of service by sending specially crafted records in response to a legitimate query by an authorized user (CVE-2018-10851).

An issue has been found in PowerDNS Recursor allowing a remote user to craft a DNS query that will cause an answer without DNSSEC records to be inserted into the packet cache and be returned to clients asking for DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname and qtype. For a DNSSEC-signed domain, this means that clients performing DNSSEC validation by themselves might consider the answer to be bogus until it expires from the packet cache, leading to a denial of service (CVE-2018-14626).

An issue has been found in PowerDNS Recursor from 4.0.0 up to and including 4.1.4. A remote attacker sending a DNS query for a meta-type like OPT can lead to a zone being wrongly cached as failing DNSSEC validation. It only arises if the parent zone is signed, and all the authoritative servers for that parent zone answer with FORMERR to a query for at least one of the meta-types. As a result, subsequent queries from clients requesting DNSSEC validation will be answered with a ServFail (CVE-2018-14644).

An issue has been found in PowerDNS Recursor where a remote attacker sending a DNS query can trigger an out-of-bounds memory read while computing the hash of the query for a packet cache lookup, possibly leading to a crash (CVE-2018-16855).

This update for pdns-recursor to version 4.1.8 fixes the following issues:

Security issues fixed:

• CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer (bsc#1114157).
• CVE-2018-14644: Fixed denial of service via crafted query for meta-types (bsc#1114170).
• CVE-2018-14626: Fixed packet cache pollution via crafted query (bsc#1114169).
• CVE-2018-16855: Fixed case where a crafted query could cause a denial of service (bsc#1116592)

Non-security issues fixed:

• Fixed build failure with Boost 1.67.0 (bsc#1089814).
• Revert ‘Keep the EDNS status of a server on FormErr with EDNS’
• Refuse queries for all meta-types

For more details about this update, refer to: https://blog.powerdns.com/2018/11/26/powerdns-recursor-4-1-8-released/

This update for pdns fixes the following issues:

Security issues fixed:

• CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer (bsc#1114157).
• CVE-2018-14626: Fixed packet cache pollution via crafted query (bsc#1114169).

This update for pdns fixes the following issues:

Security issues fixed:

• CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer (bsc#1114157).
• CVE-2018-14626: Fixed packet cache pollution via crafted query (bsc#1114169).

This update was imported from the openSUSE:Leap:15.0:Update update project.

This update for pdns-recursor fixes the following issues:

Security issues fixed:

• CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer (bsc#1114157).
• CVE-2018-14644: Fixed denial of service via crafted query for meta-types (bsc#1114170).
• CVE-2018-14626: Fixed packet cache pollution via crafted query (bsc#1114169).
• CVE-2018-16855: Fixed case where a crafted query could cause a denial of service (bsc#1116592)

This update was imported from the openSUSE:Leap:15.0:Update update project.

These are all security issues fixed in the pdns-4.5.1-1.5 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the pdns-recursor-4.5.5-1.3 package on the GA media of openSUSE Tumbleweed.

This update fixes the following issues:

cobbler:

• Fixes case where distribution detection returns None (bsc#1130658)
• SUSE texmode fix (bsc#1109316)
• Fix for SUSE distribution detection in ISO building (bsc#1123991)

py26-compat-salt:

• Remove arch from name when pkg.list_pkgs is called with 'attr' (bsc#1114029)

spacecmd:

• Fix importing state channels using configchannel_import
• Fix getting file info for latest revision (via configchannel_filedetails)

spacewalk-branding:

• Update jquery.timepicker dependency to 1.11.14 to allow parsing the time format without depending on the language. (bsc#1119081)

spacewalk-java:

• Fix a problem when cloning public child channels with a private base channel (bsc#1124639)
• Keep assigned channels on traditional to minion migration (bsc#1122836)
• Fix 'Add Selected to SSM' on System Groups -> systems page (bsc#1121856)
• Disable notification types with 'java.notifications_type_disabled' in rhn.conf (bsc#1111910)
• XMLRPC API: Include init.sls in channel file list (bsc#1111191)
• Fix the config channels assignment via SSM (bsc#1117759)

spacewalk-utils:

• Create /etc/rhn with correct ownership to prevent file conflicts

spacewalk-web:

• Fix action scheduler time picker prefill when the server is on 'UTC/GMT' timezone (bsc#1121195)
• Fix initializing of the datetime picker (bsc#1126862)
• Show feedback messages after using the retry option on the notification messages page

subscription-matcher:

• Old style hard bundle merging fix (bsc#1114059)

susemanager:

• Fix creation of bootstrap repositories for SLE12 (no SP) by requiring python-setuptools only for SLE12 >= SP1 (bsc#1129765)
• Add python-setuptools package dependency to SLES12 bootstrap repo (bsc#1119964)
• Rhnlib was renamed to python2-rhnlib. Change bootstrap data accordingly.

susemanager-schema:

• Fix performance regression in inter-server-sync (bsc#1128781)

susemanager-docs_en:

• Update text and image files
• 2.1 comparison: clarify profile syncing support
• Adjust documentation about notification settings
• Fix internal link (SMT documentation).
• Remove documentation about the 'mgr-sync enable-scc' subcommand. This subcommand is no longer available.

susemanager-frontend-libs:

• Update jquery.timepicker to 1.11.14 (bsc#1119081)

tika-core:

• New upstream version (1.20). Fixes infinite loop in SQLite3Parser (CVE-2018-17197) (bsc#1121038)

This update fixes the following issues:

cobbler:

• Fixes case where distribution detection returns None (bsc#1130658)
• SUSE texmode fix (bsc#1109316)
• Fix for SUSE distribution detection in ISO building (bsc#1123991)

py26-compat-salt:

• Remove arch from name when pkg.list_pkgs is called with 'attr' (bsc#1114029)

spacecmd:

• Fix importing state channels using configchannel_import
• Fix getting file info for latest revision (via configchannel_filedetails)

spacewalk-branding:

• Update jquery.timepicker dependency to 1.11.14 to allow parsing the time format without depending on the language. (bsc#1119081)

spacewalk-java:

• Fix a problem when cloning public child channels with a private base channel (bsc#1124639)
• Keep assigned channels on traditional to minion migration (bsc#1122836)
• Fix 'Add Selected to SSM' on System Groups -> systems page (bsc#1121856)
• Disable notification types with 'java.notifications_type_disabled' in rhn.conf (bsc#1111910)
• XMLRPC API: Include init.sls in channel file list (bsc#1111191)
• Fix the config channels assignment via SSM (bsc#1117759)

spacewalk-utils:

• Create /etc/rhn with correct ownership to prevent file conflicts

spacewalk-web:

• Fix action scheduler time picker prefill when the server is on 'UTC/GMT' timezone (bsc#1121195)
• Fix initializing of the datetime picker (bsc#1126862)
• Show feedback messages after using the retry option on the notification messages page

subscription-matcher:

• Old style hard bundle merging fix (bsc#1114059)

susemanager:

• Fix creation of bootstrap repositories for SLE12 (no SP) by requiring python-setuptools only for SLE12 >= SP1 (bsc#1129765)
• Add python-setuptools package dependency to SLES12 bootstrap repo (bsc#1119964)
• Rhnlib was renamed to python2-rhnlib. Change bootstrap data accordingly.

susemanager-schema:

• Fix performance regression in inter-server-sync (bsc#1128781)

susemanager-docs_en:

• Update text and image files
• 2.1 comparison: clarify profile syncing support
• Adjust documentation about notification settings
• Fix internal link (SMT documentation).
• Remove documentation about the 'mgr-sync enable-scc' subcommand. This subcommand is no longer available.

susemanager-frontend-libs:

• Update jquery.timepicker to 1.11.14 (bsc#1119081)

tika-core:

• New upstream version (1.20). Fixes infinite loop in SQLite3Parser (CVE-2018-17197) (bsc#1121038)

This update for ardana-ansible, ardana-barbican, ardana-db, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, documentation-suse-openstack-cloud, memcached, openstack-manila, openstack-neutron, openstack-nova, pdns, python-amqp, rubygem-puma, zookeeper contains the following fixes:

Security fix for rubygem-puma:

• CVE-2020-5247: Fixed an issue where the newlines in headers according to Rack spec were not split (bsc#1165402)

Security fix for openstack-manila:

• CVE-2020-9543: Fixed an issue where an attacker could view, update, delete, or share resources that do not

Security fixes for memcached:

• CVE-2019-15026: Fixed a stack-based buffer over-read in conn_to_str() in memcached.c (bsc#1149110).
• CVE-2019-11596: Fixed NULL pointer dereference in process_lru_command() in memcached.c (bsc#1133817).

Security fixes for pdns:

• CVE-2019-3871: Fixed a denial of service with the HTTP remote backend when the attacker can send crafted DNS queries (bsc#1129734).
• CVE-2018-10851: Fixed a denial of service via crafted zone record (bnc#1114157).
• CVE-2018-14626: Fixed a denial of service by hiding DNSSEC records using a crafted DNS query (bsc#1114169).

Security fixes for zookeeper:

• CVE-2019-0201: Fixed an information disclosure in the ACL handling (bsc#1135773).
• CVE-2017-5637: Fixed incorrect input validation with wchp/wchc four letter words (bsc#1040519).

Changes in ardana-ansible:

• Update to version 8.0+git.1583432621.24fa60e:
  • Upgrade pre-checks in Cloud 8 and Cloud 9 (SOC-10300)

Changes in ardana-barbican:

• Update to version 8.0+git.1585152761.8ef3d61:
  • monitor ardana-node-cert (SOC-10873)

Changes in ardana-db:

• Update to version 8.0+git.1583944923.03cca6c:
  • monitor MySQL TLS certificate (SOC-10873)

Changes in ardana-monasca:

• Update to version 8.0+git.1583944894.38f023a:
  • Add certificate file check alarm (SOC-10873)

Changes in ardana-mq:

• Update to version 8.0+git.1583944811.dc14403:
  • monitor RabbitMQ TLS certificate (SOC-10873)

Changes in ardana-neutron:

• Update to version 8.0+git.1584715262.e4ea620:
  • Add symlink for neutron-fwaas.json.j2 (bsc#1166290)

Changes in ardana-octavia:

• Update to version 8.0+git.1585171918.418f5cf:

  • Reconfigure monitor if needed (SOC-10873)

• Update to version 8.0+git.1585168661.135c735:

  • fix Octavia client cert redeploy (SOC-10873)

• Update to version 8.0+git.1585152502.f15907a:

  • monitor Octavia client certificate (SOC-10873)

Changes in ardana-tempest:

• Update to version 8.0+git.1585311051.6ab5488:
  • Enable port-security feature in tempest(SOC-11027)

Changes in crowbar-core:

• Update to version 5.0+git.1585575551.16781d00d:

  • upgrade: Point to config dir instead of config file (SOC-11171)
  • upgrade: Do not call neutron-evacuate-lbaasv2-agent with use_crm (SOC-11171)

• Update to version 5.0+git.1585316726.670746c8c:

  • upgrade: Fix systemd unit listing (trivial)

• Update to version 5.0+git.1585213241.46f12f9be:

  • upgrade: Remove the assignement of crowbar-upgrade role (SOC-11166)

• Update to version 5.0+git.1585118470.eed9020de:

  • Update the default value of OS version (trivial)
  • Ignore CVE-2020-5267 in CI (bsc#1167240)
  • Ignore CVE-2020-10663 in CI (bsc#1167244)

• Update to version 5.0+git.1583911121.d6b4b4b1a:

  • ses: Make SES UI safe for unknown options (trivial)
  • ses: Use cinder user for nova (SOC-11119)
  • ses: Added helper for populating cinder volumes (SOC-11117)
  • ses: Add ses cookbook (SOC-11114)
  • ses: Configuration upload (SOC-11115)

• Update to version 5.0+git.1583309007.e3a8b81e9:

  • Ignore CVE-2020-8130 in CI (bsc#1164804)
  • Ignore CVE-2020-5247 (bsc#1165402)

Changes in crowbar-ha:

• Update to version 5.0+git.1585316176.344190f:
  • add ssl termination on haproxy (bsc#1149535)

Changes in crowbar-openstack:

• Update to version 5.0+git.1585304226.2164b7895:

  • nova: Fix migration numbers (trivial)

• Update to version…

Wei Hao discovered that PowerDNS Authoritative Server incorrectly handled memory when accessing certain files. An attacker could possibly use this issue to achieve arbitrary code execution. (CVE-2018-1046)

It was discovered that PowerDNS Authoritative Server and PowerDNS Recursor incorrectly handled memory when receiving certain remote input. An attacker could possibly use this issue to cause denial of service. (CVE-2018-10851)

Kees Monshouwer discovered that PowerDNS Authoritative Server and PowerDNS Recursor incorrectly handled request validation after having cached malformed input. An attacker could possibly use this issue to cause denial of service. (CVE-2018-14626)

Toshifumi Sakaguchi discovered that PowerDNS Recursor incorrectly handled requests after having cached malformed input. An attacker could possibly use this issue to cause denial of service. (CVE-2018-14644)

Nathaniel Ferguson discovered that PowerDNS Authoritative Server incorrectly handled memory when receiving certain remote input. An attacker could possibly use this issue to obtain sensitive information. (CVE-2020-17482)

Nicolas Dehaine and Dmitry Shabanov discovered that PowerDNS Authoritative Server and PowerDNS Recursor incorrectly handled IXFR requests in certain circumstances. An attacker could possibly use this issue to cause denial of service. (CVE-2022-27227)