PowerDNS Recursor 4.0.4 released!

Jan 13, 2017

We are happy to announce the release of the PowerDNS Recursor version 4.0.4. This release fixes 2 security issues and adds several improvements to the DNSSEC validation code.

The following PowerDNS Security Advisories are fixes:

  • 2016-02: Crafted queries can cause abnormal CPU usage
  • 2016-04: Insufficient validation of TSIG signatures

Minimal patches are available for those unable to fully upgrade (2016-02, 2016-04)

The full changelog is available, highlights include:

  • Check TSIG signature on IXFR (Security Advisory 2016-04)
  • Don’t parse spurious RRs in queries when we don’t need them (Security Advisory 2016-02)
  • Add `max-recursion-depth` to limit the number of internal recursion
  • Wait until after daemonizing to start the RPZ and protobuf threads
  • On RPZ customPolicy, follow the resulting CNAME
  • Make the negcache forwarded zones aware
  • Cache records for zones that were delegated to from a forwarded zone
  • DNSSEC: don’t go bogus on zero configured DSs
  • DNSSEC: NSEC3 optout and Bogus insecure forward fixes
  • DNSSEC: Handle CNAMEs at the apex of secure zones to other secure zones

We recommend all users of the Recursor to upgrade to this version. Tarballs with sources are available (signature).

Packages for Debian Stable, Ubuntu Trusty, Xenial and Wily and CentOS 6 and 7 are available from our repositories.

About the author

Pieter Lexis

Pieter Lexis

Senior Developer at PowerDNS


Related Articles

PowerDNS Recursor 4.1.9 Released

We are very happy to announce the 4.1.9 release of the PowerDNS Recursor. This release is fixing two security issues, and...

Remi Gacogne 01/2/19

PowerDNS Authoritative Server 3.4.11 and Recursor 3.7.4 released!

Today, we are releasing version 3.4.11 of the PowerDNS Authoritative Server and version 3.7.4 of the PowerDNS Recursor....

Pieter Lexis 01/6/17

PowerDNS Authoritative Server 3.4.6 released

We’re pleased to announce the release of the PowerDNS Authoritative Server version 3.4.6. This release fixes some bugs and...

Pieter Lexis 08/6/15

PowerDNS Authoritative Server 4.0.2 released!

We are pleased to announce the release of the PowerDNS Authoritative Server 4.0.2. This release fixes several security...

Pieter Lexis 01/6/17