CVE-2020-24698

2020-10-0209:15:13

Google

osv.dev

7.8 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.1%

JSON

An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker might be able to cause a double-free, leading to a crash or possibly arbitrary code execution. by sending crafted queries with a GSS-TSIG signature.

CPENameOperatorVersion
pdnseqrec-3.3.1
pdnseqauth-4.1.0
pdnseqauth-3.3
pdnseqdnsdist-1.4.0-rc3
pdnseqrec-3.5-rc3
pdnseqauth-4.0.0-rc2
pdnseqrec-4.3.0-alpha2
pdnseqauth-4.1.0-rc3
pdnseqrec-4.3.0-beta1
pdnseqrec-4.0.0-alpha3

Name	Operator	Version
pdns	eq	rec-3.3.1
pdns	eq	auth-4.1.0
pdns	eq	auth-3.3
pdns	eq	dnsdist-1.4.0-rc3
pdns	eq	rec-3.5-rc3
pdns	eq	auth-4.0.0-rc2
pdns	eq	rec-4.3.0-alpha2
pdns	eq	auth-4.1.0-rc3
pdns	eq	rec-4.3.0-beta1
pdns	eq	rec-4.0.0-alpha3