Re: security advisory 2021-01 for PowerDNS Authoritative Server 4.5.0

--===============2076110450951303194==
Content-Type: multipart/alternative; boundary="00000000000095cf7f05cc4b93d2"

--00000000000095cf7f05cc4b93d2
Content-Type: text/plain; charset="UTF-8"

For Debian systems will apt be updated so that an upgrade from 4.4.1 to
4.5.1 can be picked up by apt upgrade?  Or is there a different upgrade
path?  I don't see any reference in
https://doc.powerdns.com/authoritative/upgrading.html#x-to-4-5-0-or-master.
Thanks in advance.

Steve Garner
+1 302 364 0325
[email protected]


On Mon, Jul 26, 2021 at 7:42 AM Peter van Dijk via Pdns-users <
[email protected]> wrote:

> Hello,
>
> today we have released PowerDNS Authoritative Server 4.5.1, fixing a
> remotely triggered crash present in version 4.5.0. No other versions
> are affected.
>
> Tarballs and signatures are available at
> https://downloads.powerdns.com/releases/, and a single patch is
> available at https://downloads.powerdns.com/patches/2021-01/. However,
> 4.5.1 contains no other changes.
>
> Please find the full text of the advisory below.
>
> PowerDNS Security Advisory 2021-01: Specific query crashes
> Authoritative Server
>
> -  CVE: CVE-2021-36754
> -  Date: July 26th, 2021
> -  Affects: PowerDNS Authoritative version 4.5.0
> -  Not affected: 4.4.x and below, 4.5.1
> -  Severity: High
> -  Impact: Denial of service
> -  Exploit: This problem can be triggered via a specific query packet
> -  Risk of system compromise: None
> -  Solution: Upgrade to 4.5.1, or filter queries in ``dnsdist``
>
> PowerDNS Authoritative Server 4.5.0 (and the alpha/beta/rc1/rc2
> prereleases that came before it) will crash with an uncaught out of
> bounds exception if it receives a query with QTYPE 65535. The offending
> code was not present in earlier versions, and they are not affected.
>
> Users that cannot upgrade immediately, but do have dnsdist in place,
> can use dnsdist to filter such queries before they do harm, with
> something like ``addAction(QTypeRule(65535),
> RCodeAction(DNSRCode.REFUSED))``.
>
> When the PowerDNS Authoritative Server is run inside a supervisor like
> supervisord or systemd, an uncaught exception crash will lead to an
> automatic restart, limiting the impact to a somewhat degraded service.
>
> We would like to thank Reinier Schoof and Robin Geuze of TransIP for
> noticing crashes in production, immediately letting us know, and
> helping us figure out what was happening.
> _______________________________________________
> Pdns-users mailing list
> [email protected]
> https://mailman.powerdns.com/mailman/listinfo/pdns-users
>

--00000000000095cf7f05cc4b93d2
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">For Debian systems will apt be updated so that an upgrade =
from 4.4.1 to 4.5.1 can be picked up by apt upgrade?=C2=A0 Or is there a di=
fferent upgrade path?=C2=A0 I don&#39;t see any reference in=C2=A0<a href=
=3D"https://doc.powerdns.com/authoritative/upgrading.html#x-to-4-5-0-or-mas=
ter">https://doc.powerdns.com/authoritative/upgrading.html#x-to-4-5-0-or-ma=
ster</a>.=C2=A0 Thanks in=C2=A0advance.<div><br clear=3D"all"><div><div dir=
=3D"ltr" class=3D"gmail_signature" data-smartmail=3D"gmail_signature"><div =
dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"=
ltr"><div style=3D"font-family:arial;font-size:small"><div>Steve Garner</di=
v><div>+1 302 364 0325<br></div><div><a href=3D"mailto:stevenjgarner@gmail.=
com">[email protected]</a></div></div></div></div></div></div></div><=
/div></div><br></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" =
class=3D"gmail_attr">On Mon, Jul 26, 2021 at 7:42 AM Peter van Dijk via Pdn=
s-users &lt;<a href=3D"mailto:[email protected]">pdns-users@m=
ailman.powerdns.com</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quot=
e" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204)=
;padding-left:1ex">Hello,<br>
<br>
today we have released PowerDNS Authoritative Server 4.5.1, fixing a<br>
remotely triggered crash present in version 4.5.0. No other versions<br>
are affected.<br>
<br>
Tarballs and signatures are available at <br>
<a href=3D"https://downloads.powerdns.com/releases/" rel=3D"noreferrer" tar=
get=3D"_blank">https://downloads.powerdns.com/releases/</a>, and a single p=
atch is<br>
available at <a href=3D"https://downloads.powerdns.com/patches/2021-01/" re=
l=3D"noreferrer" target=3D"_blank">https://downloads.powerdns.com/patches/2=
021-01/</a>. However,<br>
4.5.1 contains no other changes.<br>
<br>
Please find the full text of the advisory below.<br>
<br>
PowerDNS Security Advisory 2021-01: Specific query crashes<br>
Authoritative Server<br>
<br>
-=C2=A0 CVE: CVE-2021-36754<br>
-=C2=A0 Date: July 26th, 2021<br>
-=C2=A0 Affects: PowerDNS Authoritative version 4.5.0<br>
-=C2=A0 Not affected: 4.4.x and below, 4.5.1<br>
-=C2=A0 Severity: High<br>
-=C2=A0 Impact: Denial of service<br>
-=C2=A0 Exploit: This problem can be triggered via a specific query packet<=
br>
-=C2=A0 Risk of system compromise: None<br>
-=C2=A0 Solution: Upgrade to 4.5.1, or filter queries in ``dnsdist``<br>
<br>
PowerDNS Authoritative Server 4.5.0 (and the alpha/beta/rc1/rc2<br>
prereleases that came before it) will crash with an uncaught out of<br>
bounds exception if it receives a query with QTYPE 65535. The offending<br>
code was not present in earlier versions, and they are not affected.<br>
<br>
Users that cannot upgrade immediately, but do have dnsdist in place,<br>
can use dnsdist to filter such queries before they do harm, with<br>
something like ``addAction(QTypeRule(65535),<br>
RCodeAction(DNSRCode.REFUSED))``.<br>
<br>
When the PowerDNS Authoritative Server is run inside a supervisor like<br>
supervisord or systemd, an uncaught exception crash will lead to an<br>
automatic restart, limiting the impact to a somewhat degraded service.<br>
<br>
We would like to thank Reinier Schoof and Robin Geuze of TransIP for<br>
noticing crashes in production, immediately letting us know, and<br>
helping us figure out what was happening.<br>
_______________________________________________<br>
Pdns-users mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">Pdns-u=
[email protected]</a><br>
<a href=3D"https://mailman.powerdns.com/mailman/listinfo/pdns-users" rel=3D=
"noreferrer" target=3D"_blank">https://mailman.powerdns.com/mailman/listinf=
o/pdns-users</a><br>
</blockquote></div>

--00000000000095cf7f05cc4b93d2--

--===============2076110450951303194==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Pdns-users mailing list
[email protected]
https://mailman.powerdns.com/mailman/listinfo/pdns-users

--===============2076110450951303194==--