dnsmasq: version 2.90 (CVE 2023-50387, CVE 2023-50868) #14669
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
the
core packages
nwf
force-pushed
the
202402-dnsmasq290
branch
2 times, most recently
from
ef630a6
to
134e5cc
Compare
ynezz
reviewed
Feb 19, 2024
ynezz
changed the title
ynezz
changed the title
|
I compiled with your patch for my DL-WRX36. Do you want me to test anything else |
nwf
force-pushed
the
202402-dnsmasq290
branch
from
134e5cc
to
33160df
Compare
|
Commit message updated as per @ynezz feedback. |
|
how likely a client hit by this? or most upstream resolver will strip attack for us? |
|
Huh. interesting. #14631 would be a pseudo duplicate. I am mildly perplexed this PR exists, and appears to be still a work in progress, yet my bug was still marked "completed". |
systemcrash
approved these changes
Feb 27, 2024
|
Can this be merged? Do I need to do anything? |
|
Can anyone post ipk package 2.90 for manual replacement? |
Bump to 2.90 to get upstream's fix for DNSSEC KeyTrap (CVE-2023-50387, CVE-2023-50868) among many other goodies and fixes (notably, upstream 568fb024... fixes a UAF in cache_remove_uid that was routinely crashing dnsmasq in my deployment). Catch up our 200-ubus_dns.patch, too. Signed-off-by: Nathaniel Wesley Filardo <nwfilardo@gmail.com>
robimarko
force-pushed
the
202402-dnsmasq290
branch
from
33160df
to
838a27f
Compare
|
Thanks! Rebased on top of main and merged! |
|
Great work! Can anyone with permissions cherry-pick it for current release? @robimarko ? |
|
@stangri this is a relatively busy repo, so see if we can help out and prep the CP (of this commit) as a PR. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
@nbd168 Please review the changes to package/network/services/dnsmasq/patches/200-ubus_dns.patch . I believe they are correct, but upstream's 12ddb2a4b9204846db7c38eefe4080d89dbed708 ("To implement this needed the DNS-doctor code to be untangled from find_soa()") imposed a little bit of work.