CVE-2019-3807

Name	CVE-2019-3807
Description	An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pdns-recursor (PTS)	buster, buster (security)	4.1.11-1+deb10u1	fixed
	bullseye	4.4.2-3	fixed
	bookworm, sid	4.6.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
pdns-recursor	source	jessie	(not affected)
pdns-recursor	source	stretch	(not affected)
pdns-recursor	source	(unstable)	4.1.9-1

Notes

[stretch] - pdns-recursor <not-affected> (Only affects 4.1.x)
[jessie] - pdns-recursor <not-affected> (Only affects 4.1.x)
https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-02.html