PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception, leading to a denial of service (daemon crash) via a DNS query that leads to an answer with specific properties.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has     Improper Cleanup upon a Thrown Exception, leading to a denial of service (daemon crash) via a DNS query     that leads to an answer with specific properties. (CVE-2022-37428)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has
    Improper Cleanup upon a Thrown Exception, leading to a denial of service (daemon crash) via a DNS query
    that leads to an answer with specific properties. (CVE-2022-37428)

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2022:10171-1 advisory.

  - PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has     Improper Cleanup upon a Thrown Exception, leading to a denial of service (daemon crash) via a DNS query     that leads to an answer with specific properties. (CVE-2022-37428)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 5418b360-29cc-11ed-a6d4-6805ca2fa271 advisory.

  - PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has     Improper Cleanup upon a Thrown Exception, leading to a denial of service (daemon crash) via a DNS query     that leads to an answer with specific properties. (CVE-2022-37428)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
224859	Linux Distros Unpatched Vulnerability : CVE-2022-37428	Nessus	Misc.	medium
406263	Alpine: multiple pdns-recursor packages: security update to 4.7.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
406263	Alpine: multiple pdns-recursor packages: security update to 4.7.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
406262	Alpine: multiple pdns-recursor packages: security update to 4.6.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
406262	Alpine: multiple pdns-recursor packages: security update to 4.6.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
166760	openSUSE 15 Security Update : pdns-recursor (openSUSE-SU-2022:10171-1)	Nessus	SuSE Local Security Checks	medium
164687	FreeBSD : powerdns-recursor -- denial of service (5418b360-29cc-11ed-a6d4-6805ca2fa271)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2022-37428

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium