kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

dns/dnsmasq: security update to 2.83

Browse source 
CHANGELOG of version 2.83:

        Use the values of --min-port and --max-port in outgoing
        TCP connections to upstream DNS servers.

        Fix a remote buffer overflow problem in the DNSSEC code. Any
        dnsmasq with DNSSEC compiled in and enabled is vulnerable to this,
        referenced by CVE-2020-25681, CVE-2020-25682, CVE-2020-25683
        CVE-2020-25687.

        Be sure to only accept UDP DNS query replies at the address
        from which the query was originated. This keeps as much entropy
        in the {query-ID, random-port} tuple as possible, to help defeat
        cache poisoning attacks. Refer: CVE-2020-25684.

        Use the SHA-256 hash function to verify that DNS answers
        received are for the questions originally asked. This replaces
        the slightly insecure SHA-1 (when compiled with DNSSEC) or
        the very insecure CRC32 (otherwise). Refer: CVE-2020-25685.

        Handle multiple identical near simultaneous DNS queries better.
        Previously, such queries would all be forwarded
        independently. This is, in theory, inefficent but in practise
        not a problem, _except_ that is means that an answer for any
        of the forwarded queries will be accepted and cached.
        An attacker can send a query multiple times, and for each repeat,
        another {port, ID} becomes capable of accepting the answer he is
        sending in the blind, to random IDs and ports. The chance of a
        succesful attack is therefore multiplied by the number of repeats
        of the query. The new behaviour detects repeated queries and
        merely stores the clients sending repeats so that when the
        first query completes, the answer can be sent to all the
        clients who asked. Refer: CVE-2020-25686.
MFH:		2021Q1
Security:	5b5cf6e5-5b51-11eb-95ac-7f9491278677
Security:	CVE-2020-25684
Security:	CVE-2020-25685
Security:	CVE-2020-25686
Security:	CVE-2020-25681
Security:	CVE-2020-25682
Security:	CVE-2020-25683
Security:	CVE-2020-25687
This commit is contained in:
Matthias Andree 2021-01-20 19:20:38 +00:00
parent 6eb9a51598
commit d947e5e7ea
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=562154
2 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
dns/dnsmasq/Makefile
View file

@ -2,7 +2,7 @@
# $FreeBSD$
PORTNAME= dnsmasq
DISTVERSION= 2.82
DISTVERSION= 2.83
# Leave the PORTREVISION in even if 0 to avoid accidental PORTEPOCH bumps:
PORTREVISION= 0
PORTEPOCH= 1

6
dns/dnsmasq/distinfo
View file

@ -1,3 +1,3 @@
TIMESTAMP = 1595199532
SHA256 (dnsmasq-2.82.tar.xz) = 84523646f3116bb5e1151efb66e645030f6e6a8256f29aab444777a343ebc132
SIZE (dnsmasq-2.82.tar.xz) = 509904
TIMESTAMP = 1611169927
SHA256 (dnsmasq-2.83.tar.xz) = ffc1f7e8b05e22d910b9a71d09f1128197292766dc7c54cb7018a1b2c3af4aea
SIZE (dnsmasq-2.83.tar.xz) = 513880