aboutsummaryrefslogtreecommitdiffstats
path: root/Config.in
diff options
context:
space:
mode:
authorKevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>2018-01-19 17:16:08 +0000
committerHans Dedecker <dedeckeh@gmail.com>2018-01-19 22:11:16 +0100
commita3198061f80a7f3933810cd99206b085e4cf49f9 (patch)
tree08af0a10a298d17b794315b66af914e080c73c04 /Config.in
parent9c2ac19b032c81a454f1efbcf5681b80cad2fa39 (diff)
downloadupstream-a3198061f80a7f3933810cd99206b085e4cf49f9.tar.gz
upstream-a3198061f80a7f3933810cd99206b085e4cf49f9.tar.bz2
upstream-a3198061f80a7f3933810cd99206b085e4cf49f9.zip
dnsmasq: backport dnssec security fix
CVE-2017-15107 An interesting problem has turned up in DNSSEC validation. It turns out that NSEC records expanded from wildcards are allowed, so a domain can include an NSEC record for *.example.org and an actual query reply could expand that to anything in example.org and still have it signed by the signature for the wildcard. So, for example !.example.org NSEC zz.example.org is fine. The problem is that most implementers (your author included, but also the Google public DNS people, powerdns and Unbound) then took that record to prove the nothing exists between !.example.org and zz.example.org, whereas in fact it only provides that proof between *.example.org and zz.example.org. This gives an attacker a way to prove that anything between !.example.org and *.example.org doesn't exists, when it may well do so. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Diffstat (limited to 'Config.in')
0 files changed, 0 insertions, 0 deletions