Merge pull request #7222 from aerique/feature/update-changelog-and-secpol-for-rec...

Update changelog and secpol for rec-4.1.8.

diff --git a/docs/secpoll.zone b/docs/secpoll.zone
index e0c15ec6d7cd8aef2910b8f4ffeeed46f4d91798..69f8bb9119a5198a074601993c3f193509e1ced8 100644 (file)
--- a/docs/secpoll.zone
+++ b/docs/secpoll.zone
@@ -1,4 +1,4 @@
-@       86400   IN  SOA pdns-public-ns1.powerdns.com. pieter\.lexis.powerdns.com. 2018110901 10800 3600 604800 10800
+@       86400   IN  SOA pdns-public-ns1.powerdns.com. pieter\.lexis.powerdns.com. 2018112601 10800 3600 604800 10800
 @       3600    IN  NS  pdns-public-ns1.powerdns.com.
 @       3600    IN  NS  pdns-public-ns2.powerdns.com.
 ; Auth
@@ -162,9 +162,10 @@ recursor-4.1.1.security-status                          60 IN TXT "3 Upgrade now
 recursor-4.1.2.security-status                          60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-04.html https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-06.html https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-07.html"
 recursor-4.1.3.security-status                          60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-04.html https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-06.html https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-07.html"
 recursor-4.1.4.security-status                          60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-04.html https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-06.html https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-07.html"
-recursor-4.1.5.security-status                          60 IN TXT "1 OK"
-recursor-4.1.6.security-status                          60 IN TXT "1 OK"
-recursor-4.1.7.security-status                          60 IN TXT "1 OK"
+recursor-4.1.5.security-status                          60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-09.html"
+recursor-4.1.6.security-status                          60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-09.html"
+recursor-4.1.7.security-status                          60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-09.html"
+recursor-4.1.8.security-status                          60 IN TXT "1 OK"
 
 ; Recursor Debian
 recursor-3.6.2-2.debian.security-status                 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/3/security/powerdns-advisory-2015-01/ and https://doc.powerdns.com/3/security/powerdns-advisory-2016-02/"

diff --git a/pdns/recursordist/docs/changelog/4.1.rst b/pdns/recursordist/docs/changelog/4.1.rst
index 0bf1f438f0aa6e181c60b02f4101c29850e2cd2c..1bf8382714f4b489c4ff23a97a3aa4303ad26c20 100644 (file)
--- a/pdns/recursordist/docs/changelog/4.1.rst
+++ b/pdns/recursordist/docs/changelog/4.1.rst
@@ -1,6 +1,22 @@
 Changelogs for 4.1.x
 ====================
 
+.. changelog::
+  :version: 4.1.8
+  :released: 26th of November 2018
+
+  This release fixes :doc:`Security Advisory 2018-09 <../security-advisories/powerdns-advisory-2018-09>` that we recently discovered, affecting PowerDNS Recursor up to and including 4.1.7.
+
+  The issue is that a remote attacker can trigger an out-of-bounds memory read via a crafted query, while computing the hash of the query for a packet cache lookup, possibly leading to a crash.
+
+  When the PowerDNS Recursor is run inside a supervisor like supervisord or systemd, a crash will lead to an automatic restart, limiting the impact to a somewhat degraded service.
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 7221
+
+    Crafted query can cause a denial of service (CVE-2018-16855, PowerDNS Security Advisory :doc:`2018-09 <../security-advisories/powerdns-advisory-2018-09>`)
+
 .. changelog::
   :version: 4.1.7
   :released: 9th of November 2018

diff --git a/pdns/recursordist/docs/security-advisories/powerdns-advisory-2018-09.rst b/pdns/recursordist/docs/security-advisories/powerdns-advisory-2018-09.rst
new file mode 100644 (file)
index 0000000..ebf0bd2
--- /dev/null
+++ b/pdns/recursordist/docs/security-advisories/powerdns-advisory-2018-09.rst
@@ -0,0 +1,24 @@
+PowerDNS Security Advisory 2018-09: Crafted query can cause a denial of service
+===============================================================================
+
+-  CVE: CVE-2018-16855
+-  Date: 26th of November 2018
+-  Affects: PowerDNS Recursor from 4.1.0 up to and including 4.1.7
+-  Not affected: 4.0.x, 4.1.8
+-  Severity: Medium
+-  Impact: Denial of service
+-  Exploit: This problem can be triggered via crafted queries
+-  Risk of system compromise: No
+-  Solution: Upgrade to a non-affected version
+
+An issue has been found in PowerDNS Recursor where a remote attacker sending
+a DNS query can trigger an out-of-bounds memory read while computing the hash
+of the query for a packet cache lookup, possibly leading to a crash.
+
+This issue has been assigned CVE-2018-16855 by Red Hat.
+
+When the PowerDNS Recursor is run inside a supervisor like supervisord
+or systemd, a crash will lead to an automatic restart, limiting the impact to
+a somewhat degraded service.
+
+PowerDNS Recursor from 4.1.0 up to and including 4.1.7 is affected.