CVE-2019-13207

nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buffer Overflow in the dname_concatenate() function in dname.c.

nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buffer Overflow in the dname_concatenate() function in dname.c.

nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buffer Overflow in the dname_concatenate() function in dname.c.

nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buffer Overflow in the dname_concatenate() function in dname.c.

nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buffer Overflow in the dname_concatenate() function in dname.c.

nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buffer Overflow in the dname_concatenate() function in dname.c.

nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buffer Overflow in the dname_concatenate() function in dname.c.

This update for nsd fixes the following issues:

nsd was updated to the new upstream release 4.3.4

FEATURES:

• Merge PR #141: ZONEMD RR type.

BUG FIXES:

• Fix that symlink does not interfere with chown of pidfile (boo#1179191, CVE-2020-28935)
• Fix #128: Fix that the invalid port number is logged for sendmmsg failed: Invalid argument.
• Fix #133: fix 0-init of local ( stack ) buffer.
• Fix #134: IPV4_MINIMAL_RESPONSE_SIZE vs EDNS_MAX_MESSAGE_LEN.
• Fix to add missing closest encloser NSEC3 for wildcard nodata type DS answer.
• Fix #138: NSD returns non-EDNS answer when QUESTION is empty.
• Fix #142: NODATA answers missin SOA in authority section after CNAME chain.

New upstream release 4.3.3:

FEATURES:

• Follow DNS flag day 2020 advice and set default EDNS message size to 1232.

• Merged PR #113 with fixes. Instead of listing an IP-address to listen on, an interface name can be specified in nsd.conf, with ip-address: eth0. The IP-addresses for that interface are then used.

• New upstream release 4.3.2

FEATURES:

• Fix #96: log-only-syslog: yes sets to only use syslog, fixes that the default configuration and systemd results in duplicate log messages.
• Fix #107: nsd -v shows configure line, openssl version and libevent version.
• Fix #103 with #110: min-expire-time option. To provide a lower bound for expire period. Expressed in number of seconds or refresh+retry+1.

BUG FIXES:

• Fix to omit the listen-on lines from log at startup, unless verbose.
• Fix #97: EDNS unknown version: query not in response.
• Fix #99: Fix copying of socket properties with reuseport enabled.
• Document default value for tcp-timeout.
• Merge PR#102 from and0x000: add missing default in documentation for drop-updates.
• Fix unlink of pidfile warning if not possible due to permissions, nsd can display the message at high verbosity levels.
• Removed contrib/nsd.service, example is too complicated and not useful.
• Merge #108 from Nomis: Make the max-retry-time description clearer.
• Retry when udp send buffer is full to wait until buffer space is available.
• Remove errno reset behaviour from sendmmsg and recvmmsg replacement functions.
• Fix unit test for different nsd-control-setup -h exit code.
• Merge #112 from jaredmauch: log old and new serials when NSD rejects an IXFR due to an old serial number.
• Fix #106: Adhere better to xfrd bounds. Refresh and retry times.
• Fix #105: Clearing hash_tree means just emptying the tree.

New upstream release 4.3.1

BUG FIXES:

• Merge PR #91 by gearnode: nsd-control-setup recreate certificates. The '-r' option recreates certificates. Without it it creates them if they do not exist, and does not modify them otherwise.

New upstream release 4.3.0

FEATURES:

• Fix to use getrandom() for randomness, if available.
• Fix #56: Drop sparse TSIG signing support in NSD. Sign every axfr packet with TSIG, according to the latest draft-ietf-dnsop-rfc2845bis-06, Section 5.3.1.
• Merge pull request #59 from buddyns: add FreeBSD support for conf key ip-transparent.
• Add feature to pin server processes to specific cpus.
• Add feature to pin IP addresses to selected server processes.
• Set process title to identify individual processes.
• Merge PR#22: minimise-any: prefer polular and not large RRset, from Daisuke Higashi.
• Add support for SO_BINDTODEVICE on Linux.
• Add feature to drop queries with opcode UPDATE.

BUG FIXES:

• Fix whitespace in nsd.conf.sample.in, patch from Paul Wouters.

• use-systemd is ignored in nsd.conf, when NSD is compiled with libsystemd it always signals readiness, if possible.

• Note that use-systemd is not necessary and ignored in man page.

• Fix responses for IXFR so that the authority section is not echoed in the response.

• Fix that the retry wait does not exceed one day for zone transfers.

• Update keyring as per https://nlnetlabs.nl/people/

New upstream release 4.2.3:

• confine-to-zone configures NSD to not return out-of-zone …

These are all security issues fixed in the nsd-4.3.7-1.2 package on the GA media of openSUSE Tumbleweed.