Every CVE Search/ Get API key

CVE-2020-12244

An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer...

7.5 HighFix available

An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer, allowing an attacker to bypass DNSSEC validation.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

2.43%Up 1.0 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer, allowing an attacker to bypass DNSSEC validation.

Record
CVE-2020-12244
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-347
Updated
2026-11-02
CVE List No score

An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer, allowing an attacker to bypass DNSSEC validation.

Record
CVE-2020-12244
Updated
2026-11-02
EUVDEUVD-2020-4559 No score

An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer, allowing an attacker to bypass DNSSEC validation.

Record
EUVD-2020-4559
Updated
2026-11-03
GitHub AdvisoriesGHSA-52f2-92w4-mx97 7.5

An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer...

An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer, allowing an attacker to bypass DNSSEC validation.

Record
GHSA-52f2-92w4-mx97
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-20, CWE-347
Updated
2026-11-02
OSVALPINE-CVE-2020-12244 7.5

An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer, allowing an attacker to bypass DNSSEC validation.

Record
ALPINE-CVE-2020-12244
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
OSV 7.5

An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer, allowing an attacker to bypass DNSSEC validation.

Record
CVE-2020-12244
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2020-12244 7.5

An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer, allowing an attacker to bypass DNSSEC validation.

Record
DEBIAN-CVE-2020-12244
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2020-12244 7.5

An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer, allowing an attacker to bypass DNSSEC validation.

Record
UBUNTU-CVE-2020-12244
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVMGASA-2020-0223 No score

Updated pdns-recursor packages fix security vulnerabilities

Updated pdns-recursor packages fix security vulnerabilities:

An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect (CVE-2020-10995).

An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer. This would allow an attacker in position of man-in-the-middle to send a NXDOMAIN answer for a name that does exist, bypassing DNSSEC validation (CVE-2020-12244).

Record
MGASA-2020-0223
Updated
2026-11-02
OSVopenSUSE-SU-2020:0698-1 No score

Security update for pdns-recursor

This update for pdns-recursor fixes the following issues:

  • update to 4.1.16
    • fixes an issue where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated (CVE-2020-12244, boo#1171553)
    • fixes an issue where invalid hostname on the server can result in disclosure of invalid memory (CVE-2020-10030, boo#1171553)
    • fixes an issue in the DNS protocol has been found that allows malicious parties to use recursive DNS services to attack third party authoritative name servers (CVE-2020-10995, boo#1171553)

For details see https://doc.powerdns.com/recursor/changelog/4.1.html#change-4.1.16

Record
openSUSE-SU-2020:0698-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11157-1 No score

pdns-recursor-4.5.5-1.3 on GA media

These are all security issues fixed in the pdns-recursor-4.5.5-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11157-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pdns-recursor
Alpine:v3.10
 before 4.1.16-r0
4.1.16-r0
pdns-recursor
Alpine:v3.11
 before 4.2.2-r0
4.2.2-r0
pdns-recursor
Alpine:v3.12
 before 4.3.1-r0
4.3.1-r0
pdns-recursor
Alpine:v3.13
 before 4.3.1-r0
4.3.1-r0
pdns-recursor
Alpine:v3.14
 before 4.3.1-r0
4.3.1-r0
pdns-recursor
Alpine:v3.15
 before 4.3.1-r0
4.3.1-r0
pdns-recursor
Alpine:v3.16
 before 4.3.1-r0
4.3.1-r0
pdns-recursor
Alpine:v3.17
 before 4.3.1-r0
4.3.1-r0
pdns-recursor
Alpine:v3.18
 before 4.3.1-r0
4.3.1-r0
pdns-recursor
Alpine:v3.19
 before 4.3.1-r0
4.3.1-r0
Show 18 moreShow less
Affected packages
PackageAffectedFixed
pdns-recursor
Alpine:v3.20
 before 4.3.1-r0
4.3.1-r0
pdns-recursor
Alpine:v3.21
 before 4.3.1-r0
4.3.1-r0
pdns-recursor
Alpine:v3.22
 before 4.3.1-r0
4.3.1-r0
pdns-recursor
Alpine:v3.23
 before 4.3.1-r0
4.3.1-r0
pdns-recursor
Alpine:v3.24
 before 4.3.1-r0
4.3.1-r0
pdns-recursor
Alpine:v3.9
 before 4.1.16-r0
4.1.16-r0
pdns-recursor
Debian:12
 before 4.3.1-1
4.3.1-1
pdns-recursor
Debian:13
 before 4.3.1-1
4.3.1-1
pdns-recursor
Debian:14
 before 4.3.1-1
4.3.1-1
pdns-recursor
Debian:10
 before 4.1.11-1+deb10u1, plus listed versions
4.1.11-1
4.1.11-1+deb10u1
pdns-recursor
Mageia:7
 before 4.1.16-1.mga7
4.1.16-1.mga7
pdns-recursor
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.7.3-14.0.0~alpha1-14.0.0~alpha1-24.0.0~alpha2-24.0.0~alpha2-2ubuntu0.14.0.0~alpha2-2ubuntu0.1+esm1
 None known
pdns-recursor
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.0.6-14.0.6-1build14.0.7-14.1.1-14.1.1-1build14.1.1-24.1.1-2ubuntu0.1~esm1
 None known
pdns-recursor
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
4.2.0-64.2.1-14.2.1-1build14.2.1-1build24.2.1-1ubuntu0.1~esm1
 None known
pdns-recursor
SUSE:Package Hub 12 SP1
 before 4.1.12-bp151.4.3.1
4.1.12-bp151.4.3.1
pdns-recursor
SUSE:Package Hub 15 SP1
 before 4.1.12-bp151.4.3.1
4.1.12-bp151.4.3.1
pdns-recursor
openSUSE:Leap 15.1
 before 4.1.12-bp151.4.3.1
4.1.12-bp151.4.3.1
pdns-recursor
openSUSE:Tumbleweed
 before 4.5.5-1.3
4.5.5-1.3

History

History
RecordedChangedSources
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-12244 is a high vulnerability (CVSS 7.5) in Powerdns Recursor, published May 19, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.43%, the 84th percentile. Fixed in pdns-recursor 4.1.16-r0.

References

Show 33 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open