powerdns-recursor -- multiple vulnerabilities

PowerDNS Team reports:

CVE-2019-3806: An issue has been found in PowerDNS Recursor where Lua hooks are
not properly applied to queries received over TCP in some specific combination of
settings, possibly bypassing security policies enforced using Lua.

   When the recursor is configured to run with more than one thread (threads=X) and to
   do the distribution of incoming queries to the worker threads itself
   (pdns-distributes-queries=yes), the Lua script is not properly loaded in the thread
   handling incoming TCP queries, causing the Lua hooks to not be properly applied.

CVE-2019-3807: An issue has been found in PowerDNS Recursor where records in the
answer section of responses received from authoritative servers with the AA flag not
set were not properly validated, allowing an attacker to bypass DNSSEC validation.