CVE-2018-14663
An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a...
An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.
- Record
CVE-2018-14663- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2018-6558
An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.
- Record
EUVD-2018-6558- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r2j7-9v32-854m
An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a...
An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.
- Record
GHSA-r2j7-9v32-854m- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.
- Record
CVE-2018-14663- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.
- Record
CVE-2018-14663- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-14663
An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.
- Record
DEBIAN-CVE-2018-14663- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2018-14663
An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.
- Record
UBUNTU-CVE-2018-14663- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12731-1 No score
dnsdist-1.8.0~rc1-1.1 on GA media
These are all security issues fixed in the dnsdist-1.8.0~rc1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12731-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2760-1 No score
Security update for dnsdist
This update for dnsdist fixes the following issues:
-
update to 1.8.0
- Implements dnsdist in SLE15 (jsc#PED-3402)
- Security fix: fixes a possible record smugging with a crafted DNS query with trailing data (CVE-2018-14663, bsc#1114511)
-
update to 1.2.0 (bsc#1054799, bsc#1054802) This release also addresses two security issues of low severity, CVE-2016-7069 and CVE-2017-7557. The first issue can lead to a denial of service on 32-bit if a backend sends crafted answers, and the second to an alteration of dnsdist’s ACL if the API is enabled, writable and an authenticated user is tricked into visiting a crafted website.
- Record
SUSE-SU-2023:2760-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2760-2 No score
Security update for dnsdist
This update for dnsdist fixes the following issues:
-
update to 1.8.0
- Implements dnsdist in SLE15 (jsc#PED-3402)
- Security fix: fixes a possible record smugging with a crafted DNS query with trailing data (CVE-2018-14663, bsc#1114511)
-
update to 1.2.0 (bsc#1054799, bsc#1054802) This release also addresses two security issues of low severity, CVE-2016-7069 and CVE-2017-7557. The first issue can lead to a denial of service on 32-bit if a backend sends crafted answers, and the second to an alteration of dnsdist’s ACL if the API is enabled, writable and an authenticated user is tricked into visiting a crafted website.
- Record
SUSE-SU-2023:2760-2- Updated
- 2026-11-02
OSVSUSE-SU-2023:2777-1 No score
Security update for dnsdist
This update for dnsdist fixes the following issues:
- Implements package 'dnsdist' with version 1.8.0 in SLE15. (jsc#PED-3402)
- Downstream DNS resolver configuration should be chosen by the admin
- Security fix: fixes a possible record smugging with a crafted DNS query with trailing data (CVE-2018-14663, bsc#1114511)
- Security fix: There is an issue that can lead to a denial of service on 32-bit if a backend sends crafted answers. (CVE-2016-7069, bsc#1054799)
- Security fix: Alteration of dnsdist's ACL if the API is enabled, writable and an authenticated user is tricked into visiting a crafted website. (CVE-2017-7557, bsc#1054799)
- SNMP support, exporting statistics and sending traps
- Preventing the packet cache from ageing responses when deployed in
- Various DNSCrypt-related fixes and improvements, including automatic key rotation
- Record
SUSE-SU-2023:2777-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dnsdistDebian:12 |
before 1.3.3-1 | 1.3.3-1 |
dnsdistDebian:13 |
before 1.3.3-1 | 1.3.3-1 |
dnsdistDebian:14 |
before 1.3.3-1 | 1.3.3-1 |
dnsdistSUSE:Linux Enterprise Module for Basesystem 15 SP4 From an advisory covering 3 CVEs |
before 1.8.0-150400.9.3.1 | 1.8.0-150400.9.3.1 |
luajitSUSE:Linux Enterprise Module for Basesystem 15 SP4 From an advisory covering 3 CVEs |
before 2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1 | 2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1 |
luajitSUSE:Linux Enterprise Module for Package Hub 15 SP4 From an advisory covering 3 CVEs |
before 2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1 | 2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1 |
luajitSUSE:Linux Enterprise Module for Package Hub 15 SP5 From an advisory covering 3 CVEs |
before 2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1 | 2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1 |
luajitSUSE:Linux Enterprise Workstation Extension 15 SP4 From an advisory covering 3 CVEs |
before 2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1 | 2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1 |
luajitSUSE:Linux Enterprise Workstation Extension 15 SP5 From an advisory covering 3 CVEs |
before 2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1 | 2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1 |
dnsdistopenSUSE:Leap 15.4 From an advisory covering 3 CVEs |
before 1.8.0-150400.9.3.1 | 1.8.0-150400.9.3.1 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
luajitopenSUSE:Leap 15.4 From an advisory covering 3 CVEs |
before 2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1 | 2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1 |
dnsdistopenSUSE:Leap 15.5 From an advisory covering 3 CVEs |
before 1.8.0-150400.9.3.1 | 1.8.0-150400.9.3.1 |
luajitopenSUSE:Leap 15.5 From an advisory covering 3 CVEs |
before 2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1 | 2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1 |
dnsdistSUSE:Linux Enterprise Module for Basesystem 15 SP5 From an advisory covering 3 CVEs |
before 1.8.0-150400.9.3.1 | 1.8.0-150400.9.3.1 |
luajitSUSE:Linux Enterprise Module for Basesystem 15 SP5 From an advisory covering 3 CVEs |
before 2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1 | 2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1 |
dnsdistSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 3 CVEs |
before 1.8.0-150100.3.5.1 | 1.8.0-150100.3.5.1 |
dnsdistSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 3 CVEs |
before 1.8.0-150100.3.5.1 | 1.8.0-150100.3.5.1 |
dnsdistSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 3 CVEs |
before 1.8.0-150100.3.5.1 | 1.8.0-150100.3.5.1 |
dnsdistSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 3 CVEs |
before 1.8.0-150100.3.5.1 | 1.8.0-150100.3.5.1 |
dnsdistSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 3 CVEs |
before 1.8.0-150100.3.5.1 | 1.8.0-150100.3.5.1 |
dnsdistUbuntu:16.04:LTS |
All versions, plus listed versions 1.0.0~alpha2-1 |
None known |
dnsdistUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.2.0-11.2.0-31.2.1-11.2.1-1build11.2.1-1ubuntu0.1~esm1 |
None known |
dnsdistopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.8.0~rc1-1.1 | 1.8.0~rc1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-14663 is a medium vulnerability (CVSS 5.9) in [unknown] Dnsdist, published November 26, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.57%, the 85th percentile. Fixed in dnsdist 1.3.3-1.
References
dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2018-08.html
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14663
nvd.nist.gov/vuln/detail/CVE-2018-14663
github.com/advisories/GHSA-r2j7-9v32-854m
security-tracker.debian.org/tracker/CVE-2018-14663
suse.com/support/update/announcement/2023/suse-su-20232760-1
Show 10 moreShow less
bugzilla.suse.com/1054799
ubuntu.com/security/CVE-2018-14663
cve.org/CVERecord?id=CVE-2018-14663