Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Details of issue NIXPKGS-2025-0007

NIXPKGS-2025-0007
published on
Permalink CVE-2025-30192
7.5 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
updated 6 months, 3 weeks ago by @Erethon Activity log
  • Created automatic suggestion 8 months, 3 weeks ago
  • @Erethon accepted 8 months, 2 weeks ago
  • @Erethon deleted maintainer @rnhmjoj 6 months, 3 weeks ago maintainer.delete
  • @Erethon added maintainer @Erethon 6 months, 3 weeks ago maintainer.add
  • @Erethon published on GitHub 6 months, 3 weeks ago
A Recursor configured to send out ECS enabled queries can be sensitive to spoofing attempts

An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries. The updated version include various mitigations against spoofing attempts of ECS enabled queries by chaining ECS enabled requests and enforcing stricter validation of the received answers. The most strict mitigation done when the new setting outgoing.edns_subnet_harden (old style name edns-subnet-harden) is enabled.

Affected products

pdns-recursor
  • ==5.2.4
  • ==5.1.6
  • ==5.0.12

Matching in nixpkgs

Package maintainers

Ignored maintainers (1)

Additional maintainers