Bug 865251 (CVE-2022-33992, CVE-2022-33993)

Summary:	net-dns/dnrd: multiple vulnerabilities
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	minor	CC:	maintainer-needed
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://www.openwall.com/lists/oss-security/2022/08/14/1
Whiteboard:	B3 [upstream]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2022-08-15 16:20:15 UTC

CVE-2022-33992:

DNRD (aka Domain Name Relay Daemon) 2.20.3 forwards and caches DNS queries with the CD (aka checking disabled) bit set to 1. This leads to disabling of DNSSEC protection provided by upstream resolvers.

CVE-2022-33993:

Misinterpretation of special domain name characters in DNRD (aka Domain Name Relay Daemon) 2.20.3 leads to cache poisoning because domain names and their associated IP addresses are cached in their misinterpreted form.

URL says upstream's dead, so I guess we just need to treeclean.