ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Add CHANGES and release note for [GL #4242]

Browse Source
This commit is contained in:
Artem Boldariev
2023-08-07 18:16:29 +03:00
committed by Michal Nowak
parent 18efa454a9
commit 86df0993d7
2 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGES
View File

@@ -1,3 +1,6 @@
6246. [security] Fix use-after-free error in TLS DNS code when sending
data. (CVE-2023-4236) [GL #4242]
6245. [security] Limit the amount of recursion that can be performed
by isccc_cc_fromwire. (CVE-2023-3341) [GL #4152]

9
doc/notes/notes-current.rst
View File

@@ -23,6 +23,15 @@ Security Fixes
ISC would like to thank Eric Sesterhenn from X41 D-Sec GmbH for
bringing this vulnerability to our attention. :gl:`#4152`
- Previously, it was possible to remotely trigger a use-after-free error
in the DNS-over-TLS transport code, specifically in the code
responsible for sending data to the remote peer. This has been fixed.
(CVE-2023-4236)
ISC would like to thank Robert Story from USC/ISI Root Server
Operations for bringing this vulnerability to our attention.
:gl:`#4242`
New Features
~~~~~~~~~~~~