Security update for pdns-recursor SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:0105-1 Final 1 1 2022-04-07T04:02:44Z current 2022-04-07T04:02:44Z 2022-04-07T04:02:44Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for pdns-recursor This update for pdns-recursor fixes the following issues: - CVE-2022-27227: Fixed incomplete validation of incoming IXFR transfers. It applies to setups retrieving one or more RPZ zones from a remote server if the network path to the server is not trusted. (boo#1197525) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2022-105 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/42XLX5GUN36HINIJX75C5RSFWMGRN4OW/ E-Mail link for openSUSE-SU-2022:0105-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1197525 SUSE Bug 1197525 https://www.suse.com/security/cve/CVE-2022-27227/ SUSE CVE CVE-2022-27227 page SUSE Package Hub 15 SP3 openSUSE Leap 15.3 pdns-recursor-4.3.5-bp153.2.3.1 pdns-recursor-4.3.5-bp153.2.3.1 as a component of SUSE Package Hub 15 SP3 pdns-recursor-4.3.5-bp153.2.3.1 as a component of openSUSE Leap 15.3 In PowerDNS Authoritative Server before 4.4.3, 4.5.x before 4.5.4, and 4.6.x before 4.6.1 and PowerDNS Recursor before 4.4.8, 4.5.x before 4.5.8, and 4.6.x before 4.6.1, insufficient validation of an IXFR end condition causes incomplete zone transfers to be handled as successful transfers. CVE-2022-27227 SUSE Package Hub 15 SP3:pdns-recursor-4.3.5-bp153.2.3.1 openSUSE Leap 15.3:pdns-recursor-4.3.5-bp153.2.3.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/42XLX5GUN36HINIJX75C5RSFWMGRN4OW/ https://www.suse.com/security/cve/CVE-2022-27227.html CVE-2022-27227 https://bugzilla.suse.com/1197525 SUSE Bug 1197525