Ho nchafatsa li-server tsa BIND 9.14.4 le Knot 2.8.3 DNS

E hatisitsoe lintlafatso ho makala a tsitsitseng a seva ea DNS TLAMA 9.14.4 le 9.11.9, hammoho le lekala le ntseng le tsoela pele la liteko 9.15.2. Litokollo tse ncha li sebetsana le tlokotsi ea maemo a morabe (CVE-2019-6471) e ka lebisang ho hanetsoeng ha ts'ebeletso (ho felisoa ha ts'ebetso e hlahisoa) ha palo e kholo ea lipakete tse kenang e koetsoe.

Ho phaella moo, phetolelo e ncha ea 9.14.4 e eketsa tšehetso bakeng sa GeoIP2 API bakeng sa ho hokahanya sebaka sa polokelo ea sebaka se thehiloeng ho liaterese tsa IP tse tsoang k'hamphaning.
MaxMind (e nolofalitsoe ka ho aha ka khetho ea "--with-geoip2"). GeoIP2 ha e sa tšehetsa tse ling tsa ACLs (tse kang lebelo la marang-rang, mokhatlo, le khoutu ea naha) tse neng li tšehetsoa pele bakeng sa GeoIP API ea khale, e seng e sa hlokomeloe ke MaxMind. Metrics e ncha ea dnssec-sign le dnssec-refresh le eona e kentsoe ka li-counter bakeng sa palo ea li-signature tse entsoeng le tse ntlafalitsoeng tsa DNSSEC.

Ho phaella moo, e ka hlokomeloa lokolla Seva sa DNS Knot 2.8.3, se ekelitseng setifikeiti/faele ea tlhophiso ea senotlolo bakeng sa TLS ho kdig, litaba tse eketsehileng tsa litaba tse kenngoeng ka har'a marang-rang bakeng sa li-signature tsa KSK tse kantle ho marang-rang le mojule oa RRL, le licheke tse atolositsoeng tsa DNSSEC.

Knot Resolver 4.1.0 le eona e ile ea lokolloa, e ileng ea felisa bofokoli tse peli (CVE-2019-10190, CVE-2019-10191): Bokhoni ba ho feta licheke tsa DNSSEC bakeng sa lipotso tse sieo tsa mabitso (NXDOMAIN) le bokhoni ba ho khutlisetsa sebaka se sirelelitsoeng sa DNSSEC sebakeng se sa sireletsoang sa DNSSEC ka pakete spoofing.

Source: opennet.ru