CVE-2019-3806

Published: Jan 29, 2019Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.

Affected (1)

Products: Powerdns: Recursor

Powerdns

1 product

Recursor

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Powerdns Recursor	From 4.1.4 to 4.1.9

Related CWEs

CWE-358

Improperly Implemented Security Check for Standard

The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.

References (4)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3806

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-01.html

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3806

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-01.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.