PowerDNS Recursor 4.3.5, 4.2.5 and 4.1.18 Released

Oct 13, 2020

Hello!,

Today we are releasing PowerDNS Recursor 4.3.5, 4.2.5. and 4.1.18, containing a security fix for CVE-2020-25829:

An issue has been found in PowerDNS Recursor where a remote attacker can cause the cached records for a given name to be updated to the Bogus DNSSEC validation state, instead of their actual DNSSEC Secure state, via a DNS ANY query. This results in a denial of service for installations that always validate (dnssec=validate) and for clients requesting validation when on-demand validation is enabled (dnssec=process). The severity is high for these cases.

As usual, there were also other smaller enhancements and bugfixes. Please refer to the 4.3.5 changelog, 4.2.5 changelog and 4.1.18 changelog for details.

The 4.3.5 tarball (signature), 4.2.5 tarball (signature) and 4.1.18 tarball (signature) are available at downloads.powerdns.com and packages for CentOS 6, 7 and 8, Debian Stretch and Buster, Ubuntu Xenial and Bionic are available from repo.powerdns.com.

4.0 and older releases are EOL, refer to the documentation for details about our release cycles.

Please send us all feedback and issues you might have via the mailing list, or in case of a bug, via GitHub.

About the author

Otto Moerbeek

Otto Moerbeek

Senior Developer at PowerDNS

Categories

Related Articles

PowerDNS Recursor 4.3.2, 4.2.3 and 4.1.17 Released

Hello! Today we are releasing PowerDNS Recursor 4.3.2, 4.2.3. and 4.1.17, containing a security fix for CVE-2020-14196:...

Otto Moerbeek 07/4/20

PowerDNS Authoritative Server 4.0.8 and 4.1.10 Released

These are security releases. The 4.0.8 and 4.1.10 (together with 4.1.9) releases fix the following security advisories:...

Erik Winkels 06/6/19

PowerDNS Recursor 4.3.1, 4.2.2 and 4.1.16 Released

Hello! Today we are releasing PowerDNS Recursor 4.3.1, 4.2.2. and 4.1.16, containing security fixes for three CVEs: –...

Otto Moerbeek 05/3/20

PowerDNS Recursor 4.3.3 and 4.2.4 Released

Hello!, Today we are releasing PowerDNS Recursor 4.3.3 and 4.2.4. These releases fix an issue where the refresh time of a...

Otto Moerbeek 07/6/20