An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly

Successful exploitation of CVE-2019-3807 enables an attacker to bypass DNSSEC validation, effectively undermining the security of DNS resolution. This could allow an attacker to redirect users to malicious websites, intercept sensitive data transmitted over DNS, or perform other DNS-based attacks. The impact is particularly severe for organizations relying on DNSSEC to ensure the integrity of their DNS data. While the CVSS score is LOW, the potential for widespread impact through DNS manipulation warrants attention.

Organizations heavily reliant on DNSSEC for security and those running older versions of PowerDNS Recursor (4.1.0 - 4.1.8) are at increased risk. Shared hosting environments utilizing vulnerable PowerDNS Recursor instances are also particularly susceptible.

• linux / server:

journalctl -u pdnsrecursor | grep -i "dnssec validation"

• linux / server:

ps aux | grep pdnsrecursor

• generic web: Check DNS server logs for unusual query patterns or responses from authoritative servers without the AA flag.

1. 2019-01-29Disclosure

   disclosure

1. Gereserveerd2019-01-03
2. Gepubliceerd2019-01-29
3. Gewijzigd2024-08-04
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2019-3807 is to upgrade PowerDNS Recursor to version 4.1.9 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting queries from untrusted authoritative servers or implementing stricter DNSSEC validation policies. Monitor DNS logs for suspicious activity and consider implementing intrusion detection systems (IDS) to identify potential exploitation attempts. After upgrade, confirm by querying authoritative servers without the AA flag and verifying DNSSEC validation is enforced.