CVE-2019-3871

Name	CVE-2019-3871
Description	A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend, allowing a remote user to cause a denial of service by making the server connect to an invalid endpoint, or possibly information disclosure by making the server connect to an internal endpoint and somehow extracting meaningful information about the response
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1737-1, DSA-4424-1
Debian Bugs	924966

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pdns (PTS)	jessie, jessie (lts)	3.4.1-4+deb8u10	fixed
	stretch (security), stretch (lts), stretch	4.0.3-1+deb9u5	fixed
	buster	4.1.6-3+deb10u1	fixed
	bullseye	4.4.1-1	fixed
	bookworm	4.7.3-2	fixed
	sid, trixie	4.9.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
pdns	source	wheezy	(unfixed)	end-of-life
pdns	source	jessie	3.4.1-4+deb8u9		DLA-1737-1
pdns	source	stretch	4.0.3-1+deb9u4		DSA-4424-1
pdns	source	(unstable)	4.1.6-2			924966

Notes

https://github.com/PowerDNS/pdns/issues/7573
https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-03.html
Patches: https://downloads.powerdns.com/patches/2019-03/