NSD 4.2.2rc1 pre-release

Hi,

NSD 4.2.2rc1 maintainer's pre-release is available:
https://nlnetlabs.nl/downloads/nsd/nsd-4.2.2rc1.tar.gz
sha256 7edc758b8700d53a10f613730a77702a0ab345259f24508584fe2f5ff8b37614
pgp https://nlnetlabs.nl/downloads/nsd/nsd-4.2.2rc1.tar.gz.asc


This release fixes a number of, smaller, bugs.  Several failures are
fixed in the zone file parser, reported by fuzzing from Frederic Cambus.

NSD now warns when a zonefile is parsed with SSHFP records in it with
wrong lengths.  The record itself is still managed normally, eg. does
not cause the zone to stop loading.  They are output into log, but the
warnings are easily visible from the commandline using nsd-checkzone.


4.2.2
================
BUG FIXES:
- Fix #20: CVE-2019-13207 Stack-based Buffer Overflow in the
  dname_concatenate() function.  Reported by Frederic Cambus.
  It causes the zone parser to crash on a malformed zone file,
  with assertions enabled, an assertion catches it.
- Fix #19: Out-of-bounds read caused by improper validation of
  array index.  Reported by Frederic Cambus.  The zone parser
  fails on type SIG because of mismatched definition with RRSIG.
- PR #23: Fix typo in nsd.conf man-page.
- Fix that NSD warns for wrong length of the hash in SSHFP records.
- Fix #25: NSD doesn't refresh zones after extended downtime,
  it refreshes the old zones.
- Set no renegotiation on the SSL context to stop client
  session renegotiation.
- Fix #29: SSHFP check NULL pointer dereference.
- Fix #30: SSHFP check failure due to missing domain name.
- Fix to timeval_add in minievent for remaining second in microseconds.
- PR #31: nsd-control: Add missing stdio header.
- PR #32: tsig: Fix compilation without HAVE_SSL.
- Cleanup tls context on xfrd exit.


Best regards, Wouter

_______________________________________________
nsd-users mailing list
[email protected]
https://open.nlnetlabs.nl/mailman/listinfo/nsd-users

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE7fqj8spObrBWga+On28cLX4EX40FAl1JTpsACgkQn28cLX4E
X40/IA//QCvt54vjewM2Cd5uoWR55QdJNroZcGlkUZu70UXTzw5r+Kss27/WL4jv
hpAiuDnWTOCcsE/4MB218kQSaKMu3kGA1Yluy1ltV9yAb5sQqzejV44T+sRyHZ8y
RsGU78WNc8xcxyvcWTPWoUsqeca6sufdNx8B5O81PTqEXcsbiK0tStNbGP0v0KbV
FU5Ifspdvb8Cksfi+jR8qTbPxvJYHSk6bnEIq2oCZe3+JqVwnlVcpdkVLaRAsCgT
yVt3z4J83zbPRzp2OAoqYseYTdFmBj5PW8Dgwgctt9BaxGQboM9Ymc5ZUPydUp1E
eEa5NzERD+/lb8Zrr+Qq6CeB6JKJ//AugBKHjosWAVLrf/lSZfW/P9Oej8DWaH+Q
OqHnnuwEoONEPgaJzo/xJy98/5+8A8Ip2UKUAndz1MFse2CAQGiOYTJQF4Kw5S58
Gc0fXjS/tUMrZ0Rt0sTpP2KFV6Eqo1lCTLOyAq3nSyIBvomBpGiBfdVDnt52B1rb
KOTHRPnWU71kUjd1ujyp8iBbrPbjechhnl0ryeDwPxhdjywWCxaXQFOI5apPUPoP
CX4iBav26mnqOHf4kITd69nGdEjOo5Xda8hUtkGoKS91kUdgMM/+4pUQuIoa+yr0
k+mWRUxNiDq9lL6o0fPMDy5yJngSObmOc33UTphiXRYeTlwy390=
=j113
-----END PGP SIGNATURE-----