CVE-2017-15090

Severity: medium (CVSS 5.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-01-23 · updated 2026-06-17
Weakness: CWE-347

Description

An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter the content of records by issuing a valid signature for the crafted records.

Affected products

PowerDNS Recursor: from 4.0.0 through 4.0.6

References

http://www.securityfocus.com/bid/101982
https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2017-03.html
http://www.securityfocus.com/bid/101982
https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2017-03.html

Get alerted when CVE-2017-15090 or the next vulnerability affects your stack