Debian alert DLA-2910-1 (ldns)

From:
             
 
Chris Lamb <lamby@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 2910-1] ldns security update
Date:
             
 
Fri, 04 Feb 2022 13:06:51 -0500
Message-ID:
             
 
<164399796074.128267.2789867938806045155@copycat>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2910-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                           Chris Lamb
February 03, 2022                             https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : ldns
Version        : 1.7.0-1+deb9u1
CVE IDs        : CVE-2020-19860, CVE-2020-19861,
                 CVE-2017-1000231, CVE-2017-1000232
Debian Bugs    : #882014, #882015

It was discovered that there were four issues in ldns, a library used
in Domain Name System (DNS) related programs:

  * CVE-2020-19860: When ldns verified a zone file, the
    ldns_rr_new_frm_str_internal function had a heap out of bounds
    read vulnerability. An attacker could have potentially leaked
    information on the heap by constructing a zone file payload.

  * CVE-2020-19861: When a zone file in ldns was parsed, the function
    ldns_nsec3_salt_data was too trusting of the length value
    obtained from the zone file. This could have caused heap overflow
    information leakage.

  * CVE-2017-1000231: A double-free vulnerability in parse.c could
    have resulted in an attack vector. (#882015)

  * CVE-2017-1000232: A double-free vulnerability within str2host.c
    could have resulted in an attack vector. (#882014)

For Debian 9 "Stretch", these problems have been fixed in version
1.7.0-1+deb9u1.

We recommend that you upgrade your ldns packages.

For the detailed security status of ldns please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ldns

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmH9awcACgkQHpU+J9Qx
Hli9jxAAisg2QkEMdz2D5nqm724lzIFnaSIkTTK8zOHdYuwIsF9BhYMFBrvrB97v
l/7Vq2PXI14cKOCVGy5s4qDZOu8CWx2xZjKP7M+akY2SY1A3Htk77w0RKn7dFoK9
raoZK1pfRTTkshEtYnqYWzguX3rWm3NvrkoRgP/VcZtCdmiZ+x2HKVGv4mMt4Hfe
GnLE74RqlCXTPxVn87vbzV+gZVFvlqqKrIoQ/KXgdeS4lgwHJHP0+ovVfzseSnqe
2efX1NH3A4CKzwajXbYEjNGKxTEitR8tids8LB2AU74SIZXvTs226K8wO6t3tqgl
3Tpfs0UZDGvGBaNcx6+WheBDq6pGAYHVbHUloubRqjI172z9keLaYOxe7b5iv1fj
i8lzrEB4dC1o55wRJ1Jw6PfJGMCOQZSbu4L8zX4KQMS0TNGdjGYBgh+RakARgPWQ
8xK5lRgmuTbW8Fb7cC/TVpCc2wsuGif3SQ7sABkDjEelSbMod1ejdSSfpy111tZl
NVfyOprDAaKrhXVrhyMkinrNT8Wz7THFTjDwG2WE8Xo4uhZXA4+BA3zjtJSAWrVv
0ZbvOoc96iEuo6aelJhjBC9Zyy1TwKG059lodX0rSJgcnbX+HBLsK0WILcTfDHzV
BZv+V3LZBG7rxHvypOT4eXxrQyMcZdAIcl+rqM46vWPTgmxAZEk=
=0Jcf
-----END PGP SIGNATURE-----