NSD 4.1.23 released

Hi,

NSD 4.1.23 is available:
https://www.nlnetlabs.nl/downloads/nsd/nsd-4.1.23.tar.gz
sha256 f60ed8bd676b94a1c83c4335e8a51d61baa1a952660ecf21673a1414244b85fd
pgp https://www.nlnetlabs.nl/downloads/nsd/nsd-4.1.23.tar.gz.asc

NSD versions 4.1.22 and before are vulnerable in comparing TSIG
information and this can be used to discover a TSIG secret.

NSD uses TSIG to protect zone transfers.  The TSIG code uses a secret
key to protect the data.  The secret key is shared with both sides of
the zone transfer connection.  The comparison code in NSD was not time
insensitive, causing the potential for an attacker to use timing
information to discover data about the key contents.

NSD versions from 2.2.0 to 4.1.22 are vulnerable.  Upgrade to 4.1.23 or
newer to get the fix.

It was reported by Ondrej Sury (ISC).


4.1.23
================
BUG FIXES:
        - Fix NSD time sensitive TSIG compare vulnerability.

Best regards, Wouter

_______________________________________________
nsd-users mailing list
[email protected]
https://open.nlnetlabs.nl/mailman/listinfo/nsd-users

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE7fqj8spObrBWga+On28cLX4EX40FAltewPUACgkQn28cLX4E
X43nuQ/+KWyIQlMh/8tnt6zhnn9yR+bGGwP2i3fPaO8jx3eEDeMXHKnMJ1VGMlkZ
BMFpyYXhEavRNe7BWMDIpv3SF9+IrL3MGswU0dQhsEwnGI5Dmip+EE6vHAW132wf
EQ7w8TwbQkndnaVf3jOkf4vIRdWn1DgmbuGsz3W8j/GsINeb0Tbakp+HTpxvfh44
8nlDcNWz2O/IxvpZfygCdcNtcAZ1WbQhOE8r16gjj4/eI/Sy49xp75R5sfiR/Pei
TgFoZTU/dlthHraHaRRwFKKYLTwwlrrgXMuTPIjpaFhLeL31n3+0VPwIAo5XKG5x
rPMkYg0PiZVUqYLjOXANeOLAGkQpOUd8soDGDOEMNQfBc65p9GAhyUGrulKJ0ly1
dEYtmkTUluHQZZFi+as0iEkGdae+xdil1LFtEKTDiPZgC1gxWscWDj0Enz3JnP/L
1WqY1NJBUB3ksblEOYrcx9aT+aY6u0QfPH8QHPahX5rAW9jrxfb0FvYmbbHsJou9
xW8LQrIfOCVny4rjQ/Ve0aP9EdIZt3r1oxnZS1/6l6t6vO2qZvuRLmevIBK+IpO8
h9F2T8SlCyWMzLscXBm//wz7D3LD+okYrOWsAETzyfft6qc/G+ew4LBozMyOmDiM
fhlC5WzfkBbX55Wg8o2AJ9VgPzHKYHiLtSoyIv+IpO+reS+PdS0=
=6pj/
-----END PGP SIGNATURE-----