Date: Thu, 02 Jul 2020 08:44:36 +0000 From: bugzilla-noreply@freebsd.org To: ports-bugs@FreeBSD.org Subject: [Bug 247707] dns/powerdns-recursor: update to 4.3.2 Message-ID: <bug-247707-7788@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D247707 Bug ID: 247707 Summary: dns/powerdns-recursor: update to 4.3.2 Product: Ports & Packages Version: Latest Hardware: Any OS: Any Status: New Severity: Affects Some People Priority: --- Component: Individual Port(s) Assignee: ports-bugs@FreeBSD.org Reporter: tremere@cainites.net Created attachment 216129 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D216129&action= =3Dedit Update to PowerDNS Recursor 4.3.2 This update contains a security fix for CVE-2020-14196. The issue is: CVE-2020-14196: An issue has been found in PowerDNS Recursor where the ACL applied to the internal web server via webserver-allow-from is not properly enforced, allowing a remote attacker to send HTTP queries to the internal w= eb server, bypassing the restriction. In the default configuration the API webserver is not enabled. Only installations using a non-default value for webserver and webserver-address= are affected. As usual, there were also other smaller enhancements and bugfixes. In particular, the 4.3.2 release contains fixes that allow long CNAME chains to resolve properly, where previously they could fail if qname minimization is enabled. QA: portlint: OK (looks fine.) testport: OK (12.1, amd64) Removed file(s): files/patch-hostnamemax (no longer necessary since it has been merged by upstream) --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-247707-7788>