- update to 5.0.4:
* fixes a case when a crafted responses can lead to a denial of
service in Recursor if recursive forwarding is configured
(bsc#1223262, CVE-2024-25583)
- changes in 5.0.3
* Log if a DNSSEC related limit was hit if log_bogus is set
* Reduce RPZ memory usage by not keeping the initially loaded
RPZs in memory
* Fix the zoneToCache regression introduced by 5.0.2 security
update
OBS-URL: https://build.opensuse.org/request/show/1170013
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/pdns-recursor?expand=0&rev=66
- update to 4.8.3
* Fix serve-stale logic to not cause intermittent high CPU load by:
+ correcting the removal of a negative cache entry,
+ correcting the serve-stale main loop regarding exception handling,
+ correctly handle negcache entries with serve-state status.
- changes in version 4.8.2
* Make cache cleaning of record an negative cache more fair
* Do not report “not decreasing socket buf size” as an error
* Do not use “message” as key, it has a special meaning to systemd-journal
* Add the ‘parse packet from auth’ error message to structured logging
* Refresh of negcache stale entry might use wrong qtype
* Do not chain ECS enabled queries
* Properly encode json string containing binary data
OBS-URL: https://build.opensuse.org/request/show/1069900
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/pdns-recursor?expand=0&rev=62
- update to 4.8.0 with these major changes:
* Structured Logging has been implemented for almost all
subsystems.
* Optional Serve Stale functionality has been implemented,
providing resilience against connectivity problems towards
authoritative servers.
* Optional Record Locking has been implemented, providing an extra
layer of protection against spoofing attempts at the price of
reduced cache efficiency.
* Internal tables used to track information about authoritative
servers are now shared instead of per-thread, resulting in
better performance and lower memory usage.
* EDNS padding of outgoing DoT queries has been implemented,
providing better privacy protection.
* Metrics have been added about the protobuf and dnstap logging
subsystems and the rcodes received from authoritative
servers.
OBS-URL: https://build.opensuse.org/request/show/1042523
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/pdns-recursor?expand=0&rev=60
- update to 4.4.3:
Improvements
Use a short-lived NSEC3 hashes cache for denial validation.
References: #9856, pull request 10221
Bug Fixes
More fail-safe handling of Newly Discovered Domain files.
Handle policy (if needed) after postresolve.
Return current rcode instead of 0 if there are no CNAME records to follow.
Lookup DS entries before CNAME entries.
Handle failure to start the web server more gracefully.
Test that we correctly cap the answer’s TTL in expanded wildcard cases.
Fix the gathering of denial proof for wildcard-expanded answers.
Make sure we take the right minimum for the packet cache TTL data in the SERVFAIL case.
For details see,
https://doc.powerdns.com/recursor/changelog/4.4.html#change-4.4.3
OBS-URL: https://build.opensuse.org/request/show/882324
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/pdns-recursor?expand=0&rev=43
- update to 4.3.2
* Fixes a access restriction bypass vulnerability where ACL applied
to the internal web server via webserver-allow-from is
not properly enforced, allowing a remote attacker to send
HTTP queries to the internal web server, bypassing the restriction.
(CVE-2020-14196, bsc#1173302)
* improves CNAME loop detection
* Fix the handling of DS queries for the root
* Fix RPZ removals when an update has several deltas
OBS-URL: https://build.opensuse.org/request/show/818168
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/pdns-recursor?expand=0&rev=34
- update to 4.3.1
* fixes an issue where records in the answer section of
a NXDOMAIN response lacking an SOA were not properly validated
(CVE-2020-12244, bsc#1171553)
* fixes an issue where invalid hostname on the server can result in
disclosure of invalid memory (CVE-2020-10030, bsc#1171553)
* fixes an issue in the DNS protocol has been found that allows
malicious parties to use recursive DNS services to attack third
party authoritative name servers (CVE-2020-10995, bsc#1171553)
OBS-URL: https://build.opensuse.org/request/show/807216
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/pdns-recursor?expand=0&rev=33
- update to 4.1.6
- Revert "rec: Authority records in AA=1 CNAME answer are
authoritative"
https://github.com/PowerDNS/pdns/issues/7158
- update to 4.1.5
- Improvements
* Add pdnslog to lua configuration scripts
* Fix compilation with libressl 2.7.0+
* Export outgoing ECS value and server ID in protobuf (if any)
* Switch to devtoolset 7 for el6
* Allow the signature inception to be off by number of seconds
- Bug Fixes
* Crafted answer can cause a denial of service
(bsc#1114157, CVE-2018-10851)
* Packet cache pollution via crafted query
(bsc#1114169, CVE-2018-14626)
* Crafted query for meta-types can cause a denial of service
(bsc#1114170, CVE-2018-14644)
* Delay creation of rpz threads until we dropped privileges
* Cleanup the netmask trees used for the ecs index on removals
* Make sure that the ecs scope from the auth is < to the source
* Authority records in aa=1 cname answer are authoritative
* Avoid a memory leak in catch-all exception handler
* Don’t require authoritative answers for forward-recurse zones
* Release memory in case of error in openssl ecdsa constructor
* Convert a few uses to toLogString to print DNSName’s that
may be empty in a safer manner
* Avoid a crash on DEC Alpha systems
* Clear all caches on (N)TA changes
OBS-URL: https://build.opensuse.org/request/show/646976
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/pdns-recursor?expand=0&rev=22
- update to 4.1.4
- Improvements
* Split pdns_enable_unit_tests.
* Add a new max-udp-queries-per-round setting.
* Fix warnings reported by gcc 8.1.0.
* Tests: replace awk command by perl.
* Allow the snmp thread to retrieve statistics.
- Bug Fixes
* Don’t account chained queries more than once.
* Make rec_control respect include-dir.
* Load lua scripts only in worker threads.
* Purge all auth/forward zone data including subtree.
OBS-URL: https://build.opensuse.org/request/show/632520
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/pdns-recursor?expand=0&rev=21
- update to 4.1.3
- Improvements
* Add a subtree option to the API cache flush endpoint
* Use a separate, non-blocking pipe to distribute queries
* Move carbon/webserver/control/stats handling to a separate
thread
* Add _raw versions for QName / ComboAddresses to the FFI API
* Fix a warning on botan >= 2.5.0
- Bug Fixes
* Count a lookup into an internal auth zone as a cache miss
* Don’t increase the DNSSEC validations counters when running
with process-no-validate
* Respect the AXFR timeout while connecting to the RPZ server
* Increase MTasker stacksize to avoid crash in exception
unwinding
* Use the SyncRes time in our unit tests when checking cache
validity
* Add -rdynamic to C{,XX}FLAGS when we build with LuaJIT
* Delay the loading of RPZ zones until the parsing is done,
fixing a race condition
* Reorder includes to avoid boost L conflict (bsc#1089814)
OBS-URL: https://build.opensuse.org/request/show/611478
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/pdns-recursor?expand=0&rev=20
Version update and add missing bugzilla entries
- update to version 4.1.1:
+ Fixes security vulnerability where man-in-the-middle to send
a NXDOMAIN answer for a DNSSEC name that does exist.
(bsc#1077154, CVE-2018-1000003)
+ Don't validate signature for "glue" CNAME, since anything else
than the initial CNAME can’t be considered authoritative.
- update to version 4.0.7: (bsc#1069242)
OBS-URL: https://build.opensuse.org/request/show/568487
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/pdns-recursor?expand=0&rev=18
- enable ed25519 support (new BR: libsodium-devel)
- enable net-snmp support (new BR: net-snmp-devel)
- simplify BR for lua: lua-devel everywhere now
- update to version 4.1.0:
+ Improved DNSSEC support
+ Improved documentation
+ Improved RPZ support
+ Improved EDNS Client Subnet support
+ SNMP support
+ Lua engine has gained access to more parts of the recursor
+ CPU affinity can now be specified
+ TCP Fast Open support
+ New performance metrics
+ For complete changes see:
https://blog.powerdns.com/2017/12/04/powerdns-recursor-4-1/
- update to version 4.0.7:
+ fixes CVE-2017-15090: Insufficient validation of DNSSEC
signatures
+ fixes CVE-2017-15092: Cross-Site Scripting in the web interface
+ fixes CVE-2017-15093: Configuration file injection in the API
+ fixes CVE-2017-15094: Memory leak in DNSSEC parsing
+ Fix validation at the exact RRSIG inception or expiration time
+ Extract nested exception from Luawrapper
+ Throw an error when lua-conf-file can’t be loaded
+ Lowercase all outgoing qnames when lowercase-outgoing is set
OBS-URL: https://build.opensuse.org/request/show/555202
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/pdns-recursor?expand=0&rev=16
oid sha256:510ec4c178c3c276f98e1f5d231cfdfaa43775a8e1359f1e91e529b2b438026a
size 6998747
oid sha256:32066896f0d17d58331dc29902a5ccfeaf7c979614c3e47a014eea9ad02e62a0
size 6869041
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
