Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-25581
CVE-2024-25581:
Linux Debian vulnerability analysis and mitigation
Overview
CVE-2024-25581 is a vulnerability in PowerDNS DNSdist software versions 1.9.0 through 1.9.3, discovered by Daniel Stirnimann from Switch and disclosed on May 13th, 2024. The vulnerability affects DNSdist's handling of DNS over HTTPS (DoH) requests when using the nghttp2 provider. It has been assigned a CVSS score of 7.5 (High), though this severity only applies to specific configurations where incoming DoH is enabled and a TCP-only/DoT backend is enabled (PowerDNS Advisory).
Technical details
The vulnerability occurs when incoming DNS over HTTPS support is enabled using the nghttp2 provider and queries are routed to a tcp-only or DNS over TLS backend. An attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer (AXFR or IXFR) over DNS over HTTPS. Importantly, DNS over HTTPS is not enabled by default, and backends typically use plain DNS (Do53) by default, which limits the exposure to this vulnerability under standard configurations (PowerDNS Advisory, Security Online).
Impact
When successfully exploited, the vulnerability leads to a denial of service condition as the DNSdist process stops abruptly. This can potentially disrupt DNS resolution services for large-scale service providers, including internet service providers (ISPs) and hosting providers (Security Online).
Mitigation and workarounds
PowerDNS has released DNSdist version 1.9.4 to address this vulnerability. For users unable to upgrade immediately, two workarounds are available: 1) Refuse incoming XFR requests via a DNSdist rule using 'addAction(OrRule({QTypeRule(DNSQType.AXFR), QTypeRule(DNSQType.IXFR)}), RCodeAction(DNSRCode.REFUSED))' or 2) Switch to the legacy h2o provider by setting 'library='h2o'' in the addDOHLocal directive. Additionally, a minimal patch is available for version 1.9.3 (PowerDNS Advisory, OSS Security).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management