Read the docs
TI-2014-06010 Aliases CVE-2014-7210GHSA-jh6h-88x6-fmx3

Incorrect default permissions in Debian pdns

Priority MEDIUM 49CWE-276Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

pdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user. It was discovered that the maintainer scripts of pdns-backend-mysql grant too wide database permissions for the pdns user. Other backends are not affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00481 41st percentileScored 2026-11-07
Fix Fixed pdns (Debian): 3.3.1-1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Debianpdnsbefore 3.3.1-13.3.1-1Patch availableCNA
  • pdns VendorDebian Affected before 3.3.1-1 Fixed in 3.3.1-1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:debian:pdns:*:*:*:*:*:*:*:*before 3.3.1-1VulnerableDebian
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*7.0VulnerableDebian
  • cpe:2.3:a:debian:pdns:*:*:*:*:*:*:*:* Versions before 3.3.1-1 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Debian

Remediation

  • Fix · CNA pdns (Debian) Fixed in 3.3.1-1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-7210
  2. 2026-10-03 Alias added: GHSA-jh6h-88x6-fmx3

References

Patch 1

Advisory 1

  • TI-2026-19388 telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root"… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-31204 Deserialization of untrusted data in Roundcube Webmail KEVCVSS 3.1CRITICAL 9.9
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-23504 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-17951 Out-of-bounds write in Apple Safari KEVCVSS 3.1CRITICAL 10.0
See all 10013 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences