git: ee336d30650b - main - security/vuxml: add dns/powerdns-recursor entry for CVE-2025-30192
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 24 Jul 2025 13:08:56 UTC
The branch main has been updated by tagattie:
URL: https://cgit.FreeBSD.org/ports/commit/?id=ee336d30650bace075385d207fa8ce05e44ced2d
commit ee336d30650bace075385d207fa8ce05e44ced2d
Author: Ralf van der Enden <tremere@cainites.net>
AuthorDate: 2025-07-24 07:43:28 +0000
Commit: Hiroki Tagato <tagattie@FreeBSD.org>
CommitDate: 2025-07-24 13:08:36 +0000
security/vuxml: add dns/powerdns-recursor entry for CVE-2025-30192
PR: 288384
Reported by: Ralf van der Enden <tremere@cainites.net>
Obtained from: https://blog.powerdns.com/powerdns-security-advisory-2025-04
---
security/vuxml/vuln/2025.xml | 33 +++++++++++++++++++++++++++++++++
1 file changed, 33 insertions(+)
diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml
index d7f9c531e855..33dfef7bac21 100644
--- a/security/vuxml/vuln/2025.xml
+++ b/security/vuxml/vuln/2025.xml
@@ -1,3 +1,36 @@
+ <vuln vid="b3948bf3-685e-11f0-bff5-6805ca2fa271">
+ <topic>powerdns-recursor -- cache pollution</topic>
+ <affects>
+ <package>
+ <name>powerdns-recursor</name>
+ <range><lt>5.2.4</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>PowerDNS Team reports:</p>
+ <blockquote cite="https://blog.powerdns.com/powerdns-security-advisory-2025-04">
+ <p>An attacker spoofing answers to ECS enabled requests
+ sent out by the Recursor has a chance of success higher
+ than non-ECS enabled queries. The updated version include
+ various mitigations against spoofing attempts of ECS enabled
+ queries by chaining ECS enabled requests and enforcing
+ stricter validation of the received answers. The most strict
+ mitigation done when the new setting outgoing.edns_subnet_harden
+ (old style name edns-subnet-harden) is enabled.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2025-30192</cvename>
+ <url>https://nvd.nist.gov/vuln/detail/CVE-2025-30192</url>
+ </references>
+ <dates>
+ <discovery>2025-07-21</discovery>
+ <entry>2025-07-24</entry>
+ </dates>
+ </vuln>
+
<vuln vid="5683b3a7-683d-11f0-966e-2cf05da270f3">
<topic>Gitlab -- vulnerabilities</topic>
<affects>