[nsd-users] NSD 4.2.2rc2 pre-release

[Wouter Wijngaards]

Hi,

NSD 4.2.2rc2 maintainer's pre-release is available:
https://nlnetlabs.nl/downloads/nsd/nsd-4.2.2rc2.tar.gz
sha256 22b59d6e749322e7fc83b3fda12c5bf8c6a1a7b83f9dda0bd278f25d7dd2b02d
pgp https://nlnetlabs.nl/downloads/nsd/nsd-4.2.2rc2.tar.gz

This RC2 is made because there is a last-minute bugfix that fixes a
segfault, and it is nice to fold this into the release in progress.

Additional changes:
- Fix #33: Fix segfault in service of remaining streams on exit.
- Fix error message for out of zone data to have more information.

Best regards, Wouter

On 8/6/19 11:55 AM, Wouter Wijngaards wrote:
> Hi,
> 
> NSD 4.2.2rc1 maintainer's pre-release is available:
> https://nlnetlabs.nl/downloads/nsd/nsd-4.2.2rc1.tar.gz
> sha256 7edc758b8700d53a10f613730a77702a0ab345259f24508584fe2f5ff8b37614
> pgp https://nlnetlabs.nl/downloads/nsd/nsd-4.2.2rc1.tar.gz.asc
> 
> 
> This release fixes a number of, smaller, bugs.  Several failures are
> fixed in the zone file parser, reported by fuzzing from Frederic Cambus.
> 
> NSD now warns when a zonefile is parsed with SSHFP records in it with
> wrong lengths.  The record itself is still managed normally, eg. does
> not cause the zone to stop loading.  They are output into log, but the
> warnings are easily visible from the commandline using nsd-checkzone.
> 
> 
> 4.2.2
> ================
> BUG FIXES:
> - Fix #20: CVE-2019-13207 Stack-based Buffer Overflow in the
>   dname_concatenate() function.  Reported by Frederic Cambus.
>   It causes the zone parser to crash on a malformed zone file,
>   with assertions enabled, an assertion catches it.
> - Fix #19: Out-of-bounds read caused by improper validation of
>   array index.  Reported by Frederic Cambus.  The zone parser
>   fails on type SIG because of mismatched definition with RRSIG.
> - PR #23: Fix typo in nsd.conf man-page.
> - Fix that NSD warns for wrong length of the hash in SSHFP records.
> - Fix #25: NSD doesn't refresh zones after extended downtime,
>   it refreshes the old zones.
> - Set no renegotiation on the SSL context to stop client
>   session renegotiation.
> - Fix #29: SSHFP check NULL pointer dereference.
> - Fix #30: SSHFP check failure due to missing domain name.
> - Fix to timeval_add in minievent for remaining second in microseconds.
> - PR #31: nsd-control: Add missing stdio header.
> - PR #32: tsig: Fix compilation without HAVE_SSL.
> - Cleanup tls context on xfrd exit.
> 
> 
> Best regards, Wouter
> 
> 
> _______________________________________________
> maintainers mailing list
> maintainers at nlnetlabs.nl
> https://nlnetlabs.nl/mailman/listinfo/maintainers
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.nlnetlabs.nl/pipermail/nsd-users/attachments/20190813/c8b52a01/attachment.bin>