Re: [Buildroot] [PATCH v2, 1/1] package/bind: security bump to version 9.16.44

From: Peter Korsgaard <peter@korsgaard.com>
To: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Cc: buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH v2, 1/1] package/bind: security bump to version 9.16.44
Date: Thu, 28 Sep 2023 11:26:35 +0200	[thread overview]
Message-ID: <874jjey7g4.fsf@48ers.dk> (raw)
In-Reply-To: <20230927204329.626845-1-fontaine.fabrice@gmail.com> (Fabrice Fontaine's message of "Wed, 27 Sep 2023 22:43:29 +0200")

>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes:

 > Fix CVE-2023-3341: The code that processes control channel messages sent
 > to `named` calls certain functions recursively during packet parsing.
 > Recursion depth is only limited by the maximum accepted packet size;
 > depending on the environment, this may cause the packet-parsing code to
 > run out of available stack memory, causing `named` to terminate
 > unexpectedly. Since each incoming control channel message is fully
 > parsed before its contents are authenticated, exploiting this flaw does
 > not require the attacker to hold a valid RNDC key; only network access
 > to the control channel's configured TCP port is necessary. This issue
 > affects BIND 9 versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18,
 > 9.19.0 through 9.19.16, 9.9.3-S1 through 9.16.43-S1, and 9.18.0-S1
 > through 9.18.18-S1.

 > https://ftp.isc.org/isc/bind9/9.16.44/CHANGES

 > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
 > ---
 > Changes v1 -> v2:
 >  - fix tarball hash

Committed, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot