CVE-2017-15094 — Missing Release of Memory after Effective Lifetime in Recursor
Severity
5.9MEDIUMNVD
EPSS
0.0%
top 99.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 23
Latest updateMay 13
Description
An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than off or process-no-validate (default).
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6
Affected Packages2 packages
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-q452-p523-w4f9: An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4↗2022-05-13
OSV▶
CVE-2017-15094: An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4↗2018-01-23
CVEList▶
CVE-2017-15094: An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4↗2018-01-23
📋Vendor Advisories
1Debian▶
CVE-2017-15094: pdns-recursor - An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0...↗2017