Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 715222

Summary: <net-dns/unbound-1.10.0: Crash when parsing WKS records
Product: Gentoo Security Reporter: Sam James <sam>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: minor CC: mschiff, whissi
Priority: Normal Flags: nattka: sanity-check+
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://github.com/NLnetLabs/unbound/releases/tag/release-1.10.0
Whiteboard: B3 [noglsa]
Package list:
net-dns/unbound-1.10.0 amd64 arm ppc ppc64 x86
 Runtime testing required: ---

Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-03-29 05:53:24 UTC 
Description (from 1.10.0 release notes):
>- Fix out-of-bounds null-byte write in sldns_bget_token_par while
>  parsing type WKS, reported by Luis Merino from X41 D-Sec.

Patch: https://github.com/NLnetLabs/unbound/commit/05a5dc2d0d7d1c9054af48913079abebff06a5a1

A few double frees were also fixed in this release.
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-03-29 05:53:50 UTC 
@maintainer(s), please advise if ready for stabilisation, or call yourself.
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-04-18 09:01:42 UTC 
@maintainer(s): ping
Comment 3 Agostino Sarubbo gentoo-dev 2020-04-19 19:01:11 UTC 
x86 stable
Comment 4 Agostino Sarubbo gentoo-dev 2020-04-20 09:45:26 UTC 
amd64 stable
Comment 5 Agostino Sarubbo gentoo-dev 2020-04-20 13:27:40 UTC 
arm stable
Comment 6 Agostino Sarubbo gentoo-dev 2020-04-20 18:03:58 UTC 
ppc stable
Comment 7 Agostino Sarubbo gentoo-dev 2020-04-20 18:04:50 UTC 
ppc64 stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 8 Larry the Git Cow gentoo-dev 2020-04-21 00:14:48 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e72c01fbb1df2a7e21f3f6f7eb5ac69b11ee2c5e

commit e72c01fbb1df2a7e21f3f6f7eb5ac69b11ee2c5e
Author:     Thomas Deutschmann <whissi@gentoo.org>
AuthorDate: 2020-04-20 22:26:23 +0000
Commit:     Thomas Deutschmann <whissi@gentoo.org>
CommitDate: 2020-04-20 23:59:33 +0000

    net-dns/unbound: security cleanup
    
    Bug: https://bugs.gentoo.org/715222
    Package-Manager: Portage-2.3.99, Repoman-2.3.22
    Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>

 net-dns/unbound/Manifest             |   1 -
 net-dns/unbound/unbound-1.9.6.ebuild | 183 -----------------------------------
 2 files changed, 184 deletions(-)
Comment 9 Thomas Deutschmann (RETIRED) gentoo-dev 2020-04-21 00:16:14 UTC 
GLSA Vote: No

Repository is clean, all done!