security advisory 2021-01 for PowerDNS Authoritative Server 4.5.0

--===============6567306100101805589==
Content-Type: multipart/signed; micalg="pgp-sha512";
	protocol="application/pgp-signature"; boundary="=-Py57AxoiaA3clbeWrnra"


--=-Py57AxoiaA3clbeWrnra
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello,

today we have released PowerDNS Authoritative Server 4.5.1, fixing a
remotely triggered crash present in version 4.5.0. No other versions
are affected.

Tarballs and signatures are available at=20
https://downloads.powerdns.com/releases/, and a single patch is
available at https://downloads.powerdns.com/patches/2021-01/. However,
4.5.1 contains no other changes.

Please find the full text of the advisory below.

PowerDNS Security Advisory 2021-01: Specific query crashes
Authoritative Server

-  CVE: CVE-2021-36754
-  Date: July 26th, 2021
-  Affects: PowerDNS Authoritative version 4.5.0
-  Not affected: 4.4.x and below, 4.5.1
-  Severity: High
-  Impact: Denial of service
-  Exploit: This problem can be triggered via a specific query packet
-  Risk of system compromise: None
-  Solution: Upgrade to 4.5.1, or filter queries in ``dnsdist``

PowerDNS Authoritative Server 4.5.0 (and the alpha/beta/rc1/rc2
prereleases that came before it) will crash with an uncaught out of
bounds exception if it receives a query with QTYPE 65535. The offending
code was not present in earlier versions, and they are not affected.

Users that cannot upgrade immediately, but do have dnsdist in place,
can use dnsdist to filter such queries before they do harm, with
something like ``addAction(QTypeRule(65535),
RCodeAction(DNSRCode.REFUSED))``.

When the PowerDNS Authoritative Server is run inside a supervisor like
supervisord or systemd, an uncaught exception crash will lead to an
automatic restart, limiting the impact to a somewhat degraded service.

We would like to thank Reinier Schoof and Robin Geuze of TransIP for
noticing crashes in production, immediately letting us know, and
helping us figure out what was happening.

--=-Py57AxoiaA3clbeWrnra
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org

iQJQBAABCgA6FiEE+64DI4IcdwalyhUb3PUT+n7tGfMFAmD+rZgcHHBldGVyLnZh
bi5kaWprQHBvd2VyZG5zLmNvbQAKCRDc9RP6fu0Z8/p+EACVtG9RAHqVsApYA9Nl
TS77cKdGU/1kZI8YatgonVGWEl7SkrFZQH2QZ3/Qm9A9j02xsr/ZgldOeuqDavrR
rwbxawtuj8LSzh2PMJ5BbTY4NZIzR9YQRMNgioXQApqHRATF4ew50wmbWlKGDd1L
yv2+vapiTXesLh7LnL/i37D/DvwVVLceiIb+FUEOP3NB3isW3xAE1ZvGF6feaBn1
fDj8B3gB4bKW5C4nlLUysGU/VEK6bmWIZD0n7bD4T/5LrCQacI6vPzufD5ZfSiXj
t7j1n/U4VbU5lTmQoEDBMG46LRuRulMpqOZs5twj1n/BA1Iy3j89w2pr4EDSRBpN
KdR8NCJ2yUGsO92H3O105LVsa8NnHGJKZEVwFUSjx3GmWVhHR5r8VasceOBvf0Ze
UM1rnY3eaqRgqcU0FU8nxSZJazg3a2XVwvEECk2cxCDSkj2IfqQo3TLFJLMxJ0ng
n7tBw9ixRjfbw6dYCrvhHld4AekhXX/7Trx83PNXdsfApkqZ/5UYITqcrxn/4z2a
nPM30hg6s31Xb1F7DyUs+xQ2HN9fKPwPMo071R7PzLfcqRGZHgRwK1H/SDSiaSiM
2uI67fmCUMNPRndtl0RaJboBYumRnU2+AhnXOQrgdqxmQ7x74Qhcr/p2n7UqWIxZ
4sXSllH4UUhDW2LFc/6aKV1/+g==
=L+zT
-----END PGP SIGNATURE-----

--=-Py57AxoiaA3clbeWrnra--


--===============6567306100101805589==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Pdns-dev mailing list
[email protected]
https://mailman.powerdns.com/mailman/listinfo/pdns-dev

--===============6567306100101805589==--