{"id":"CVE-2019-3806","state":"PUBLISHED","title":"An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of","description":"An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.","publishedAt":"2019-01-29T17:00:00.000Z","updatedAt":"2024-08-04T19:19:18.319Z","severity":{"score":5.4,"label":"Medium","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["Power DNS pdns-recursor"],"affected":[{"vendor":"Power DNS","product":"pdns-recursor","versions":[{"version":"versions after 4.1.3 before 4.1.9","status":"affected"}]}],"references":["https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-01.html","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3806"],"weaknesses":["CWE-358"],"ingestedAt":"2026-10-29T19:45:59.128Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/3xxx/CVE-2019-3806.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2019-3806","state":"PUBLISHED","datePublished":"2019-01-29T17:00:00.000Z","dateUpdated":"2024-08-04T19:19:18.319Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2019-01-03T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua."}],"affected":[{"vendor":"Power DNS","product":"pdns-recursor","versions":[{"version":"versions after 4.1.3 before 4.1.9","status":"affected"}]}],"references":[{"url":"https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-01.html","tags":["x_refsource_CONFIRM"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3806","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_0":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H","version":"3.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-358","description":"CWE-358","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","dateUpdated":"2019-01-29T16:57:01.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749"},"datePublic":"2019-01-21T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","ID":"CVE-2019-3806","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"pdns-recursor","version":{"version_data":[{"version_value":"versions after 4.1.3 before 4.1.9"}]}}]},"vendor_name":"Power DNS"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua."}]},"impact":{"cvss":[[{"vectorString":"5.4/CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H","version":"3.0"}]]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-358"}]}]},"references":{"reference_data":[{"name":"https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-01.html","refsource":"CONFIRM","url":"https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-01.html"},{"name":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3806","refsource":"CONFIRM","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3806"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-01.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3806","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T19:19:18.319Z"}}]}}}