Vulnerability-Lookup

ubuntu-cve-2019-3871

Vulnerability from osv_ubuntu

Published

2019-03-21 21:29

Modified

2025-09-08 16:45

Summary

Details

A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend, allowing a remote user to cause a denial of service by making the server connect to an invalid endpoint, or possibly information disclosure by making the server connect to an internal endpoint and somehow extracting meaningful information about the response

Severity

6.5 (Medium)


                    
                      CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

8.8 (High)


                    
                      CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2019-3871	REPORT
	https://github.com/PowerDNS/pdns/issues/7573	REPORT
	https://docs.powerdns.com/authoritative/security-…	REPORT
	https://www.cve.org/CVERecord?id=CVE-2019-3871	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "pdns-backend-geoip",
            "binary_version": "4.0.0~alpha2-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-ldap",
            "binary_version": "4.0.0~alpha2-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-lua",
            "binary_version": "4.0.0~alpha2-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-mydns",
            "binary_version": "4.0.0~alpha2-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-mysql",
            "binary_version": "4.0.0~alpha2-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-pgsql",
            "binary_version": "4.0.0~alpha2-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-pipe",
            "binary_version": "4.0.0~alpha2-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-remote",
            "binary_version": "4.0.0~alpha2-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-sqlite3",
            "binary_version": "4.0.0~alpha2-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-tinydns",
            "binary_version": "4.0.0~alpha2-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-server",
            "binary_version": "4.0.0~alpha2-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-tools",
            "binary_version": "4.0.0~alpha2-3ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "pdns",
        "purl": "pkg:deb/ubuntu/pdns@4.0.0~alpha2-3ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.4.5-1build2",
        "3.4.6-2",
        "3.4.6-3",
        "3.4.7-1",
        "3.4.7-2",
        "4.0.0~alpha1-1",
        "4.0.0~alpha2-2",
        "4.0.0~alpha2-3",
        "4.0.0~alpha2-3build1",
        "4.0.0~alpha2-3ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "pdns-backend-bind",
            "binary_version": "4.1.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-geoip",
            "binary_version": "4.1.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-ldap",
            "binary_version": "4.1.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-lua",
            "binary_version": "4.1.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-mydns",
            "binary_version": "4.1.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-mysql",
            "binary_version": "4.1.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-odbc",
            "binary_version": "4.1.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-opendbx",
            "binary_version": "4.1.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-pgsql",
            "binary_version": "4.1.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-pipe",
            "binary_version": "4.1.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-remote",
            "binary_version": "4.1.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-sqlite3",
            "binary_version": "4.1.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-backend-tinydns",
            "binary_version": "4.1.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-server",
            "binary_version": "4.1.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "pdns-tools",
            "binary_version": "4.1.1-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "pdns",
        "purl": "pkg:deb/ubuntu/pdns@4.1.1-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.0.4-2",
        "4.0.4-2build1",
        "4.0.5-1",
        "4.1.0-1",
        "4.1.0-2",
        "4.1.0-2build1",
        "4.1.1-1",
        "4.1.1-1ubuntu0.1~esm1"
      ]
    }
  ],
  "aliases": [],
  "details": "A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend, allowing a remote user to cause a denial of service by making the server connect to an invalid endpoint, or possibly information disclosure by making the server connect to an internal endpoint and somehow extracting meaningful information about the response",
  "id": "UBUNTU-CVE-2019-3871",
  "modified": "2025-09-08T16:45:14Z",
  "published": "2019-03-21T21:29:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2019-3871"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/PowerDNS/pdns/issues/7573"
    },
    {
      "type": "REPORT",
      "url": "https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-03.html"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-3871"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2019-3871"
  ]
}

CVE-2019-3871 (GCVE-0-2019-3871)

Vulnerability from cvelistv5 – Published: 2019-03-21 20:42 – Updated: 2024-08-04 19:19

Summary

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

CWE

CWE-20

Assigner

redhat redhat root

References

10 references

URL	Tags
http://www.openwall.com/lists/oss-security/2019/03/18/4	mailing-listx_refsource_MLIST
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2…	x_refsource_CONFIRM
https://doc.powerdns.com/authoritative/security-a…	x_refsource_MISC
http://www.securityfocus.com/bid/107491	vdb-entryx_refsource_BID
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://www.debian.org/security/2019/dsa-4424	vendor-advisoryx_refsource_DEBIAN
https://seclists.org/bugtraq/2019/Apr/8	mailing-listx_refsource_BUGTRAQ

Impacted products

1 product

Vendor	Product	Version
The PowerDNS Project	pdns	Affected: 4.1.7 Affected: 4.0.7

Date Public

2019-03-18 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:19:18.676Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20190318 PowerDNS Security Advisory 2019-03",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2019/03/18/4"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3871"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-03.html"
          },
          {
            "name": "107491",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/107491"
          },
          {
            "name": "FEDORA-2019-b85d4171d4",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWUHF6MRSQ3YO7UUISGLV7MXCAGBW2VD/"
          },
          {
            "name": "FEDORA-2019-9993d32c48",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ROFI6OTWF4GKONNSNEDUCW6LVSSEBZNF/"
          },
          {
            "name": "[debian-lts-announce] 20190329 [SECURITY] [DLA 1737-1] pdns security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00039.html"
          },
          {
            "name": "openSUSE-SU-2019:1128",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00022.html"
          },
          {
            "name": "DSA-4424",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4424"
          },
          {
            "name": "20190404 [SECURITY] [DSA 4424-1] pdns security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Apr/8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pdns",
          "vendor": "The PowerDNS Project",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.7"
            },
            {
              "status": "affected",
              "version": "4.0.7"
            }
          ]
        }
      ],
      "datePublic": "2019-03-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend, allowing a remote user to cause a denial of service by making the server connect to an invalid endpoint, or possibly information disclosure by making the server connect to an internal endpoint and somehow extracting meaningful information about the response"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-04-05T04:06:09.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[oss-security] 20190318 PowerDNS Security Advisory 2019-03",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2019/03/18/4"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3871"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-03.html"
        },
        {
          "name": "107491",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/107491"
        },
        {
          "name": "FEDORA-2019-b85d4171d4",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWUHF6MRSQ3YO7UUISGLV7MXCAGBW2VD/"
        },
        {
          "name": "FEDORA-2019-9993d32c48",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ROFI6OTWF4GKONNSNEDUCW6LVSSEBZNF/"
        },
        {
          "name": "[debian-lts-announce] 20190329 [SECURITY] [DLA 1737-1] pdns security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00039.html"
        },
        {
          "name": "openSUSE-SU-2019:1128",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00022.html"
        },
        {
          "name": "DSA-4424",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4424"
        },
        {
          "name": "20190404 [SECURITY] [DSA 4424-1] pdns security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Apr/8"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2019-3871",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "pdns",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.1.7"
                          },
                          {
                            "version_value": "4.0.7"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "The PowerDNS Project"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend, allowing a remote user to cause a denial of service by making the server connect to an invalid endpoint, or possibly information disclosure by making the server connect to an internal endpoint and somehow extracting meaningful information about the response"
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "6.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[oss-security] 20190318 PowerDNS Security Advisory 2019-03",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2019/03/18/4"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3871",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3871"
            },
            {
              "name": "https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-03.html",
              "refsource": "MISC",
              "url": "https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-03.html"
            },
            {
              "name": "107491",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/107491"
            },
            {
              "name": "FEDORA-2019-b85d4171d4",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GWUHF6MRSQ3YO7UUISGLV7MXCAGBW2VD/"
            },
            {
              "name": "FEDORA-2019-9993d32c48",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ROFI6OTWF4GKONNSNEDUCW6LVSSEBZNF/"
            },
            {
              "name": "[debian-lts-announce] 20190329 [SECURITY] [DLA 1737-1] pdns security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00039.html"
            },
            {
              "name": "openSUSE-SU-2019:1128",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00022.html"
            },
            {
              "name": "DSA-4424",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4424"
            },
            {
              "name": "20190404 [SECURITY] [DSA 4424-1] pdns security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Apr/8"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2019-3871",
    "datePublished": "2019-03-21T20:42:35.000Z",
    "dateReserved": "2019-01-03T00:00:00.000Z",
    "dateUpdated": "2024-08-04T19:19:18.676Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.