Date: Wed, 20 Jan 2021 19:20:39 +0000 (UTC) From: Matthias Andree <mandree@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r562154 - head/dns/dnsmasq Message-ID: <202101201920.10KJKdTN001696@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: mandree Date: Wed Jan 20 19:20:38 2021 New Revision: 562154 URL: https://svnweb.freebsd.org/changeset/ports/562154 Log: dns/dnsmasq: security update to 2.83 CHANGELOG of version 2.83: Use the values of --min-port and --max-port in outgoing TCP connections to upstream DNS servers. Fix a remote buffer overflow problem in the DNSSEC code. Any dnsmasq with DNSSEC compiled in and enabled is vulnerable to this, referenced by CVE-2020-25681, CVE-2020-25682, CVE-2020-25683 CVE-2020-25687. Be sure to only accept UDP DNS query replies at the address from which the query was originated. This keeps as much entropy in the {query-ID, random-port} tuple as possible, to help defeat cache poisoning attacks. Refer: CVE-2020-25684. Use the SHA-256 hash function to verify that DNS answers received are for the questions originally asked. This replaces the slightly insecure SHA-1 (when compiled with DNSSEC) or the very insecure CRC32 (otherwise). Refer: CVE-2020-25685. Handle multiple identical near simultaneous DNS queries better. Previously, such queries would all be forwarded independently. This is, in theory, inefficent but in practise not a problem, _except_ that is means that an answer for any of the forwarded queries will be accepted and cached. An attacker can send a query multiple times, and for each repeat, another {port, ID} becomes capable of accepting the answer he is sending in the blind, to random IDs and ports. The chance of a succesful attack is therefore multiplied by the number of repeats of the query. The new behaviour detects repeated queries and merely stores the clients sending repeats so that when the first query completes, the answer can be sent to all the clients who asked. Refer: CVE-2020-25686. MFH: 2021Q1 Security: 5b5cf6e5-5b51-11eb-95ac-7f9491278677 Security: CVE-2020-25684 Security: CVE-2020-25685 Security: CVE-2020-25686 Security: CVE-2020-25681 Security: CVE-2020-25682 Security: CVE-2020-25683 Security: CVE-2020-25687 Modified: head/dns/dnsmasq/Makefile head/dns/dnsmasq/distinfo Modified: head/dns/dnsmasq/Makefile ============================================================================== --- head/dns/dnsmasq/Makefile Wed Jan 20 19:11:51 2021 (r562153) +++ head/dns/dnsmasq/Makefile Wed Jan 20 19:20:38 2021 (r562154) @@ -2,7 +2,7 @@ # $FreeBSD$ PORTNAME= dnsmasq -DISTVERSION= 2.82 +DISTVERSION= 2.83 # Leave the PORTREVISION in even if 0 to avoid accidental PORTEPOCH bumps: PORTREVISION= 0 PORTEPOCH= 1 Modified: head/dns/dnsmasq/distinfo ============================================================================== --- head/dns/dnsmasq/distinfo Wed Jan 20 19:11:51 2021 (r562153) +++ head/dns/dnsmasq/distinfo Wed Jan 20 19:20:38 2021 (r562154) @@ -1,3 +1,3 @@ -TIMESTAMP = 1595199532 -SHA256 (dnsmasq-2.82.tar.xz) = 84523646f3116bb5e1151efb66e645030f6e6a8256f29aab444777a343ebc132 -SIZE (dnsmasq-2.82.tar.xz) = 509904 +TIMESTAMP = 1611169927 +SHA256 (dnsmasq-2.83.tar.xz) = ffc1f7e8b05e22d910b9a71d09f1128197292766dc7c54cb7018a1b2c3af4aea +SIZE (dnsmasq-2.83.tar.xz) = 513880
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202101201920.10KJKdTN001696>