« Volver al listado

CVE-2018-14626

Estado: ModificadaAlta (7.5)—

PowerDNS Authoritative Server 4.1.0 up to 4.1.4 inclusive and PowerDNS Recursor 4.0.0 up to 4.1.4 inclusive are vulnerable to a packet cache pollution via crafted query that can lead to denial of service.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Powerdns — AuthoritativePowerdns — Recursor

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-14626",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "The PowerDNS Project",
          "product": "pdns",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.0 to 4.1.4 inclusive"
            }
          ]
        },
        {
          "vendor": "The PowerDNS Project",
          "product": "pdns-recursor",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.0 to 4.1.4 inclusive"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-11-29T18:29:00.477",
  "references": [
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14626",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2018-05.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-06.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14626",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2018-05.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-06.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "PowerDNS Authoritative Server 4.1.0 up to 4.1.4 inclusive and PowerDNS Recursor 4.0.0 up to 4.1.4 inclusive are vulnerable to a packet cache pollution via crafted query that can lead to denial of service."
    },
    {
      "lang": "es",
      "value": "PowerDNS Authoritative Server desde la versión 4.1.0 hasta la 4.1.4 y PowerDNS Recursor desde la versión 4.0.0 hasta la 4.1.4, son vulnerables a una contaminación de memora caché de paquetes mediante una consulta manipulada que puede provocar una denegación de servicio (DoS)."
    }
  ],
  "lastModified": "2026-06-17T01:41:19.207",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CC6D884E-61CF-41C3-8020-ABCA01B97EF3",
              "versionEndIncluding": "4.1.4",
              "versionStartIncluding": "4.1.0"
            },
            {
              "criteria": "cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E865DFB-08E7-4EBE-B8E0-955314EE532D",
              "versionEndIncluding": "4.1.4",
              "versionStartIncluding": "4.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}