{"id":"CVE-2017-7557","aliases":["DEBIAN-CVE-2017-7557","EUVD-2017-16564","GHSA-337m-69vh-g93q","SUSE-SU-2023:2760-1","SUSE-SU-2023:2760-2","SUSE-SU-2023:2777-1","UBUNTU-CVE-2017-7557"],"status":"published","title":"dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API...","description":"dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00838,"percentile":0.58027,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287","CWE-352"],"published":"2017-08-22T14:00:00Z","modified":"2026-10-24T10:30:17Z","fixes":[{"ecosystem":"Debian:12","package":"dnsdist","fixed_in":["1.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dnsdist","fixed_in":["1.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dnsdist","fixed_in":["1.2.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150100.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150100.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150100.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150100.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150100.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0~alpha2-1"]}],"products":[{"vendor":"powerdns","product":"dnsdist"},{"vendor":"red hat, inc.","product":"dnsdist"}],"references":[{"url":"https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2017-02.html","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"http://www.securityfocus.com/bid/100508","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7557"},{"url":"https://github.com/advisories/GHSA-337m-69vh-g93q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-7557","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232760-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1054799","tags":["report"]},{"url":"https://bugzilla.suse.com/1054802","tags":["report"]},{"url":"https://bugzilla.suse.com/1114511","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14663","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232760-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232777-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-7557","tags":["report"]},{"url":"https://downloads.powerdns.com/patches/2017-02","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7557","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-7557","description":"dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.","status":"published","published":"2017-08-22T14:00:00Z","modified":"2024-09-16T18:19:26.001Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:33:20.488433Z"}],"euvd":[{"id":"EUVD-2017-16564","description":"dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.","status":"published","published":"2017-08-22T14:00:00Z","modified":"2024-09-16T18:19:26Z","updated_at":"2026-11-03T00:55:33.363823Z"}],"ghsa":[{"id":"GHSA-337m-69vh-g93q","title":"dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API...","description":"dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.","status":"published","published":"2022-05-13T01:36:17Z","modified":"2025-04-20T03:44:48Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287","CWE-352"],"updated_at":"2026-11-02T15:01:51.143792Z"}],"nvd":[{"id":"CVE-2017-7557","description":"dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.","status":"published","published":"2017-08-22T14:29:00.257Z","modified":"2026-06-17T01:24:36.333Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-287","CWE-352"],"updated_at":"2026-11-02T14:03:57.82609Z"}],"osv":[{"id":"CVE-2017-7557","description":"dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.","status":"published","published":"2017-08-22T14:29:00.257Z","modified":"2026-10-24T10:30:17.857108554Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.412595Z"},{"id":"DEBIAN-CVE-2017-7557","description":"dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.","status":"published","published":"2017-08-22T14:29:00.257Z","modified":"2026-09-01T20:03:50.235140002Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"UBUNTU-CVE-2017-7557","description":"dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.","status":"published","published":"2017-08-22T14:29:00Z","modified":"2025-10-24T04:46:15Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"SUSE-SU-2023:2760-1","title":"Security update for dnsdist","description":"This update for dnsdist fixes the following issues:\n\n\n- update to 1.8.0\n  - Implements dnsdist in SLE15 (jsc#PED-3402)\n  - Security fix: fixes a possible record smugging with a crafted DNS query with trailing data (CVE-2018-14663, bsc#1114511)\n\n- update to 1.2.0 (bsc#1054799, bsc#1054802)\n  This release also addresses two security issues of low severity, CVE-2016-7069 and CVE-2017-7557. The first issue can lead to a\n  denial of service on 32-bit if a backend sends crafted answers,\n  and the second to an alteration of dnsdist’s ACL if the API is\n  enabled, writable and an authenticated user is tricked into\n  visiting a crafted website. \n","status":"published","published":"2023-12-06T09:47:21Z","modified":"2026-02-04T04:04:28.442725Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2760-2","title":"Security update for dnsdist","description":"This update for dnsdist fixes the following issues:\n\n\n- update to 1.8.0\n  - Implements dnsdist in SLE15 (jsc#PED-3402)\n  - Security fix: fixes a possible record smugging with a crafted DNS query with trailing data (CVE-2018-14663, bsc#1114511)\n\n- update to 1.2.0 (bsc#1054799, bsc#1054802)\n  This release also addresses two security issues of low severity, CVE-2016-7069 and CVE-2017-7557. The first issue can lead to a\n  denial of service on 32-bit if a backend sends crafted answers,\n  and the second to an alteration of dnsdist’s ACL if the API is\n  enabled, writable and an authenticated user is tricked into\n  visiting a crafted website. \n","status":"published","published":"2023-12-06T09:47:21Z","modified":"2026-02-04T04:37:56.7693Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2777-1","title":"Security update for dnsdist","description":"This update for dnsdist fixes the following issues:\n\n- Implements package 'dnsdist' with version 1.8.0 in SLE15. (jsc#PED-3402)\n- Downstream DNS resolver configuration should be chosen by the admin\n- Security fix: fixes a possible record smugging with a crafted DNS query with trailing data (CVE-2018-14663, bsc#1114511)\n- Security fix: There is an issue that can lead to a denial of service on 32-bit if a backend sends crafted answers. (CVE-2016-7069, bsc#1054799)\n- Security fix: Alteration of dnsdist's ACL if the API is enabled, writable and an authenticated user is tricked into visiting a crafted website. (CVE-2017-7557, bsc#1054799)\n- SNMP support, exporting statistics and sending traps\n- Preventing the packet cache from ageing responses when deployed in\n- Various DNSCrypt-related fixes and improvements, including automatic key rotation\n  ","status":"published","published":"2023-07-04T08:39:57Z","modified":"2026-02-04T03:52:30.910743Z","updated_at":"2026-11-02T15:53:53.019382Z"}]}}