{"id":"CVE-2019-3807","aliases":["ALPINE-CVE-2019-3807","DEBIAN-CVE-2019-3807","EUVD-2019-13433","GHSA-3h27-2wg2-w59m","MGASA-2019-0051","UBUNTU-CVE-2019-3807","openSUSE-SU-2019:0100-1","openSUSE-SU-2019:0107-1","openSUSE-SU-2019:0131-1","openSUSE-SU-2024:11157-1"],"status":"published","title":"An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the...","description":"An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation.","severity":{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00368,"percentile":0.31067,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295","CWE-345"],"published":"2019-01-23T15:50:09Z","modified":"2026-11-03T06:31:38Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"pdns-recursor","fixed_in":["4.1.9-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"pdns-recursor","fixed_in":["4.1.9-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pdns-recursor","fixed_in":["4.1.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pdns-recursor","fixed_in":["4.1.9-1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15","package":"pdns-recursor","fixed_in":["4.1.2-bp150.2.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.3-1","4.0.0~alpha1-1","4.0.0~alpha1-2","4.0.0~alpha2-2","4.0.0~alpha2-2ubuntu0.1","4.0.0~alpha2-2ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.6-1","4.0.6-1build1","4.0.7-1","4.1.1-1","4.1.1-1build1","4.1.1-2","4.1.1-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-bp150.2.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 12 SP1","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.10-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.5-1.3"}]}],"bundled":18}],"products":[{"vendor":"power dns","product":"pdns-recursor"},{"vendor":"powerdns","product":"recursor"}],"references":[{"url":"https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-02.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3807","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3807"},{"url":"https://github.com/advisories/GHSA-3h27-2wg2-w59m"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-3807","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-3807","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0051.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24218","tags":["report"]},{"url":"https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-01.html","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-3807","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3807","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7DZ33GPMM4JD3FOFUQLHTR6HCPLZ34FY/#7DZ33GPMM4JD3FOFUQLHTR6HCPLZ34FY","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1121889","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3807","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EODQST47JNQ5TQLSUG7LE7WYOD6DFJRT/#EODQST47JNQ5TQLSUG7LE7WYOD6DFJRT","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LWT54KXW3PC2R7C5X6T7EOO7G2AIPPBJ/#LWT54KXW3PC2R7C5X6T7EOO7G2AIPPBJ","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1121887","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3806","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25829","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-3807","description":"An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation.","status":"published","published":"2019-01-29T17:00:00Z","modified":"2024-08-04T19:19:18.394Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2019-13433","description":"An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation.","status":"published","published":"2019-01-29T17:00:00Z","modified":"2024-08-04T19:19:18Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T03:06:54.939848Z"}],"ghsa":[{"id":"GHSA-3h27-2wg2-w59m","title":"An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the...","description":"An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation.","status":"published","published":"2022-05-13T01:31:16Z","modified":"2023-02-01T05:08:19Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:50:44.010322Z"}],"nvd":[{"id":"CVE-2019-3807","description":"An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation.","status":"published","published":"2019-01-29T17:29:00.35Z","modified":"2026-06-17T02:35:37.79Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-345","CWE-295"],"updated_at":"2026-11-02T14:05:02.989216Z"}],"osv":[{"id":"ALPINE-CVE-2019-3807","description":"An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation.","status":"published","published":"2019-01-29T17:29:00.35Z","modified":"2026-11-03T06:31:38.18797921Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:18:23.800469Z"},{"id":"CVE-2019-3807","description":"An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation.","status":"published","published":"2019-01-29T17:29:00.35Z","modified":"2026-10-24T10:30:45.600856949Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-3807","description":"An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation.","status":"published","published":"2019-01-29T17:29:00.35Z","modified":"2026-09-21T07:03:17.983086002Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"UBUNTU-CVE-2019-3807","description":"An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation.","status":"published","published":"2019-01-29T17:29:00Z","modified":"2025-09-08T16:45:13Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"MGASA-2019-0051","title":"Updated pdns-recursor package fixes security vulnerabilities","description":"An issue has been found in PowerDNS Recursor where Lua hooks are not\nproperly applied to queries received over TCP in some specific\ncombination of settings, possibly bypassing security policies enforced\nusing Lua (CVE-2019-3806).\n\nAn issue has been found in PowerDNS Recursor where records in the answer\nsection of responses received from authoritative servers with the AA\nflag not set were not properly validated, allowing an attacker to bypass\nDNSSEC validation (CVE-2019-3807).\n","status":"published","published":"2019-01-23T15:50:09Z","modified":"2026-04-16T04:44:06.447717765Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:0100-1","title":"Security update for pdns-recursor","description":"This update for pdns-recursor fixes the following issues:\n\n- CVE-2019-3807: Fixed insufficient validation of DNSSEC signatures (boo#1121889)\n","status":"published","published":"2019-03-23T10:50:57Z","modified":"2026-02-04T02:26:28.934266Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2019:0107-1","title":"Security update for pdns-recursor","description":"This update for pdns-recursor fixes the following issues:\n\n- CVE-2019-3807: Fixed insufficient validation of DNSSEC signatures (boo#1121889)\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-01-31T13:36:30Z","modified":"2026-02-04T03:41:21.977355Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2019:0131-1","title":"Security update for pdns-recursor","description":"This update for pdns-recursor to version 4.1.10 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-3806: Fixed a case when Lua hooks are not called over TCP (boo#1121887)\n- CVE-2019-3807: Fixed an issue where DNSSEC validation was not performed for AA=0 responses (boo#1121889)\n","status":"published","published":"2019-02-04T12:59:24Z","modified":"2026-02-04T03:23:57.318388Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:11157-1","title":"pdns-recursor-4.5.5-1.3 on GA media","description":"These are all security issues fixed in the pdns-recursor-4.5.5-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:57:58.848357Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}