From: aerique Date: Mon, 26 Nov 2018 14:56:40 +0000 (+0100) Subject: Merge pull request #7222 from aerique/feature/update-changelog-and-secpol-for-rec... X-Git-Tag: auth-4.2.0-alpha1~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4b7866739c949d97640ab7cec7f15e438bebeb6c;p=thirdparty%2Fpdns.git Merge pull request #7222 from aerique/feature/update-changelog-and-secpol-for-rec-4.1.8 Update changelog and secpol for rec-4.1.8. --- diff --git a/docs/secpoll.zone b/docs/secpoll.zone index e0c15ec6d7..69f8bb9119 100644 --- a/docs/secpoll.zone +++ b/docs/secpoll.zone @@ -1,4 +1,4 @@ -@ 86400 IN SOA pdns-public-ns1.powerdns.com. pieter\.lexis.powerdns.com. 2018110901 10800 3600 604800 10800 +@ 86400 IN SOA pdns-public-ns1.powerdns.com. pieter\.lexis.powerdns.com. 2018112601 10800 3600 604800 10800 @ 3600 IN NS pdns-public-ns1.powerdns.com. @ 3600 IN NS pdns-public-ns2.powerdns.com. ; Auth @@ -162,9 +162,10 @@ recursor-4.1.1.security-status 60 IN TXT "3 Upgrade now recursor-4.1.2.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-04.html https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-06.html https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-07.html" recursor-4.1.3.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-04.html https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-06.html https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-07.html" recursor-4.1.4.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-04.html https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-06.html https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-07.html" -recursor-4.1.5.security-status 60 IN TXT "1 OK" -recursor-4.1.6.security-status 60 IN TXT "1 OK" -recursor-4.1.7.security-status 60 IN TXT "1 OK" +recursor-4.1.5.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-09.html" +recursor-4.1.6.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-09.html" +recursor-4.1.7.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-09.html" +recursor-4.1.8.security-status 60 IN TXT "1 OK" ; Recursor Debian recursor-3.6.2-2.debian.security-status 60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/3/security/powerdns-advisory-2015-01/ and https://doc.powerdns.com/3/security/powerdns-advisory-2016-02/" diff --git a/pdns/recursordist/docs/changelog/4.1.rst b/pdns/recursordist/docs/changelog/4.1.rst index 0bf1f438f0..1bf8382714 100644 --- a/pdns/recursordist/docs/changelog/4.1.rst +++ b/pdns/recursordist/docs/changelog/4.1.rst @@ -1,6 +1,22 @@ Changelogs for 4.1.x ==================== +.. changelog:: + :version: 4.1.8 + :released: 26th of November 2018 + + This release fixes :doc:`Security Advisory 2018-09 <../security-advisories/powerdns-advisory-2018-09>` that we recently discovered, affecting PowerDNS Recursor up to and including 4.1.7. + + The issue is that a remote attacker can trigger an out-of-bounds memory read via a crafted query, while computing the hash of the query for a packet cache lookup, possibly leading to a crash. + + When the PowerDNS Recursor is run inside a supervisor like supervisord or systemd, a crash will lead to an automatic restart, limiting the impact to a somewhat degraded service. + + .. change:: + :tags: Bug Fixes + :pullreq: 7221 + + Crafted query can cause a denial of service (CVE-2018-16855, PowerDNS Security Advisory :doc:`2018-09 <../security-advisories/powerdns-advisory-2018-09>`) + .. changelog:: :version: 4.1.7 :released: 9th of November 2018 diff --git a/pdns/recursordist/docs/security-advisories/powerdns-advisory-2018-09.rst b/pdns/recursordist/docs/security-advisories/powerdns-advisory-2018-09.rst new file mode 100644 index 0000000000..ebf0bd27f6 --- /dev/null +++ b/pdns/recursordist/docs/security-advisories/powerdns-advisory-2018-09.rst @@ -0,0 +1,24 @@ +PowerDNS Security Advisory 2018-09: Crafted query can cause a denial of service +=============================================================================== + +- CVE: CVE-2018-16855 +- Date: 26th of November 2018 +- Affects: PowerDNS Recursor from 4.1.0 up to and including 4.1.7 +- Not affected: 4.0.x, 4.1.8 +- Severity: Medium +- Impact: Denial of service +- Exploit: This problem can be triggered via crafted queries +- Risk of system compromise: No +- Solution: Upgrade to a non-affected version + +An issue has been found in PowerDNS Recursor where a remote attacker sending +a DNS query can trigger an out-of-bounds memory read while computing the hash +of the query for a packet cache lookup, possibly leading to a crash. + +This issue has been assigned CVE-2018-16855 by Red Hat. + +When the PowerDNS Recursor is run inside a supervisor like supervisord +or systemd, a crash will lead to an automatic restart, limiting the impact to +a somewhat degraded service. + +PowerDNS Recursor from 4.1.0 up to and including 4.1.7 is affected.