{"id":"CVE-2019-3806","aliases":["ALPINE-CVE-2019-3806","DEBIAN-CVE-2019-3806","EUVD-2019-13432","GHSA-3jqp-f4vw-9c87","MGASA-2019-0051","UBUNTU-CVE-2019-3806","openSUSE-SU-2019:0131-1","openSUSE-SU-2024:11157-1"],"status":"published","title":"An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks...","description":"An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01453,"percentile":0.73774,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-358"],"published":"2019-01-23T15:50:09Z","modified":"2026-11-03T06:31:58Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"pdns-recursor","fixed_in":["4.1.9-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pdns-recursor","fixed_in":["4.1.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pdns-recursor","fixed_in":["4.1.9-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.3-1","4.0.0~alpha1-1","4.0.0~alpha1-2","4.0.0~alpha2-2","4.0.0~alpha2-2ubuntu0.1","4.0.0~alpha2-2ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.6-1","4.0.6-1build1","4.0.7-1","4.1.1-1","4.1.1-1build1","4.1.1-2","4.1.1-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 12 SP1","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.10-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.5-1.3"}]}],"bundled":18}],"products":[{"vendor":"power dns","product":"pdns-recursor"},{"vendor":"powerdns","product":"recursor"}],"references":[{"url":"https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-01.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3806","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3806"},{"url":"https://github.com/advisories/GHSA-3jqp-f4vw-9c87"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-3806","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-3806","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0051.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24218","tags":["report"]},{"url":"https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-02.html","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-3806","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3806","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LWT54KXW3PC2R7C5X6T7EOO7G2AIPPBJ/#LWT54KXW3PC2R7C5X6T7EOO7G2AIPPBJ","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1121887","tags":["report"]},{"url":"https://bugzilla.suse.com/1121889","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3807","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25829","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-3806","description":"An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.","status":"published","published":"2019-01-29T17:00:00Z","modified":"2024-08-04T19:19:18.319Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-358"],"updated_at":"2026-11-02T14:20:22.701371Z"}],"euvd":[{"id":"EUVD-2019-13432","description":"An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.","status":"published","published":"2019-01-29T17:00:00Z","modified":"2024-08-04T19:19:18Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T03:06:54.939848Z"}],"ghsa":[{"id":"GHSA-3jqp-f4vw-9c87","title":"An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks...","description":"An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.","status":"published","published":"2022-05-13T01:14:29Z","modified":"2023-02-01T05:04:24Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:50:09.415947Z"}],"nvd":[{"id":"CVE-2019-3806","description":"An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.","status":"published","published":"2019-01-29T17:29:00.287Z","modified":"2026-06-17T02:35:37.677Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-358"],"updated_at":"2026-11-02T14:05:02.989216Z"}],"osv":[{"id":"ALPINE-CVE-2019-3806","description":"An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.","status":"published","published":"2019-01-29T17:29:00.287Z","modified":"2026-11-03T06:31:58.390408973Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2019-3806","description":"An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.","status":"published","published":"2019-01-29T17:29:00.287Z","modified":"2026-10-24T10:30:36.348630438Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-3806","description":"An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.","status":"published","published":"2019-01-29T17:29:00.287Z","modified":"2026-09-21T07:01:24.018644052Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"UBUNTU-CVE-2019-3806","description":"An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.","status":"published","published":"2019-01-29T17:29:00Z","modified":"2025-09-08T16:45:13Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H","level":"medium"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"MGASA-2019-0051","title":"Updated pdns-recursor package fixes security vulnerabilities","description":"An issue has been found in PowerDNS Recursor where Lua hooks are not\nproperly applied to queries received over TCP in some specific\ncombination of settings, possibly bypassing security policies enforced\nusing Lua (CVE-2019-3806).\n\nAn issue has been found in PowerDNS Recursor where records in the answer\nsection of responses received from authoritative servers with the AA\nflag not set were not properly validated, allowing an attacker to bypass\nDNSSEC validation (CVE-2019-3807).\n","status":"published","published":"2019-01-23T15:50:09Z","modified":"2026-04-16T04:44:06.447717765Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:0131-1","title":"Security update for pdns-recursor","description":"This update for pdns-recursor to version 4.1.10 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-3806: Fixed a case when Lua hooks are not called over TCP (boo#1121887)\n- CVE-2019-3807: Fixed an issue where DNSSEC validation was not performed for AA=0 responses (boo#1121889)\n","status":"published","published":"2019-02-04T12:59:24Z","modified":"2026-02-04T03:23:57.318388Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:11157-1","title":"pdns-recursor-4.5.5-1.3 on GA media","description":"These are all security issues fixed in the pdns-recursor-4.5.5-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:57:58.848357Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}