CVE catalog

CVE-2018-14663

dnsdist: CVE-2018-14663

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.57% · Oct 25, 2026

An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandnsdistsid2.1.3-1fixed
Debiandnsdistforky2.1.3-1fixed
Debiandnsdisttrixie1.9.16-0+deb13u1fixed
Debiandnsdisttrixie-security1.9.16-0+deb13u1fixed
Debiandnsdistbookworm1.7.3-2fixed
Ubuntudnsdist16.041.0.0~alpha2-1vulnerable
Ubuntudnsdistpro1.2.0-1vulnerable
Ubuntudnsdistpro1.2.0-3vulnerable
Ubuntudnsdistpro1.2.1-1vulnerable
Ubuntudnsdistpro1.2.1-1build1vulnerable
Ubuntudnsdistpro1.2.1-1ubuntu0.1~esm1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandnsdistsourcesid1.3.3-1not yet assignedNot reported[913231]
Debiandnsdistsourceforky1.3.3-1not yet assignedNot reported[913231]
Debiandnsdistsourcetrixie1.3.3-1not yet assignedNot reported[913231]
Debiandnsdistsourcebookworm1.3.3-1not yet assignedNot reported[913231]

[Debian bug #913231]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [dnsdist]Unknown
    Details (2)

    • 1.7.3-2 · amd64 · bookworm

      Fixed · Fixed: 1.3.3-1

      dsa · dnsdist · debian · bookworm; dsa · dnsdist · debian · 12

    • 1.7.3-2 · arm64 · bookworm

      Fixed · Fixed: 1.3.3-1

      dsa · dnsdist · debian · bookworm; dsa · dnsdist · debian · 12

[Debian 13 (Trixie)]

  • [dnsdist]Unknown
    Details (4)

    • 1.9.15-0+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.3.3-1

      dsa · dnsdist · debian · 13

    • 1.9.15-0+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.3.3-1

      dsa · dnsdist · debian · 13

    • 1.9.16-0+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.3.3-1

      dsa · dnsdist · debian · 13

    • 1.9.16-0+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.3.3-1

      dsa · dnsdist · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]