CVE-2025-59029
Description
A flaw was found in PowerDNS. This vulnerability allows an attacker to trigger an assertion failure via requesting crafted DNS (Domain Name System) records, waiting for them to be inserted into the records cache, then sending a query with qtype set to ANY.
Statement
This vulnerability is rated Moderate for Red Hat because an attacker can trigger an assertion failure in PowerDNS by requesting crafted DNS records and then sending a query with qtype set to ANY. This could lead to a denial of service for the PowerDNS service.
Mitigation
To mitigate this issue, restrict network access to the PowerDNS service to only trusted clients or networks. This can be achieved by configuring firewall rules to limit incoming connections to the PowerDNS port (typically UDP/TCP 53). For example, using `firewalld`: `sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_NETWORK>" port port="53" protocol="udp" accept'` and `sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_NETWORK>" port port="53" protocol="tcp" accept'`. After applying firewall rules, reload the firewall: `sudo firewall-cmd --reload`. This may impact legitimate DNS resolution if not configured carefully. A service restart may be required for changes to take full effect.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker that can trigger an assert statement can still lead to a denial of service if the relevant code can be triggered by an attacker, and if the scope of the assert() extends beyond the attacker's own session.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
