[Bug 294225] dns/dnsdist upgrade to 2.0.3 fix CVE-2026-0396, CVE-2026-0397, CVE-2026-24028, CVE-2026-24029, CVE-2026-24030, CVE-2026-27853, CVE-2026-27854

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294225

            Bug ID: 294225
           Summary: dns/dnsdist upgrade to 2.0.3 fix CVE-2026-0396,
                    CVE-2026-0397, CVE-2026-24028, CVE-2026-24029,
                    CVE-2026-24030, CVE-2026-27853, CVE-2026-27854
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Many People
          Priority: ---
         Component: Individual Port(s)
          Assignee: ports-bugs@FreeBSD.org
          Reporter: jordan@ostreff.info
                CC: tremere@cainites.net
             Flags: maintainer-feedback?(tremere@cainites.net)
                CC: tremere@cainites.net

Created attachment 269334
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=269334&action=edit
upgrade to 2.0.3

Here is my proposal of the update. Rust/Cargo components updated to latest
versions supported by dnsdist. 
Tested on adm64 stable/15 freebsd.

The issues fixed in these releases are:

CVE-2026-0396: An attacker might be able to inject HTML content into the
internal web dashboard by sending crafted DNS queries to a DNSdist instance
where domain-based dynamic rules have been enabled via either
"DynBlockRulesGroup:setSuffixMatchRule" or
"DynBlockRulesGroup:setSuffixMatchRuleFFI"
CVE-2026-0397: When the internal webserver is enabled (default is disabled), an
attacker might be able to trick an administrator logged to the dashboard into
visiting a malicious website and extract information about the running
configuration from the dashboard
CVE-2026-24028: An attacker might be able to trigger an out-of-bounds read by
sending a crafted DNS response packet, when custom Lua code uses
"newDNSPacketOverlay" to parse DNS packets
CVE-2026-24029: When the "early_acl_drop" ("earlyACLDrop" in Lua) option is
disabled (default is enabled) on a DNS over HTTPs frontend using the "nghttp2"
provider, the ACL check is skipped, allowing all clients to send DoH queries
regardless of the configured ACL
CVE-2026-24030: An attacker might be able to trick DNSdist into allocating too
much memory while processing DNS over QUIC or DNS over HTTP/3 payloads,
resulting in denial of service
CVE-2026-27853: An attacker might be able to trigger an out-of-bounds write by
sending crafted DNS responses to a DNSdist using the "DNSQuestion:changeName"
or "DNSResponse:changeName" methods in custom Lua code. In some cases the
rewritten packet might become larger than the initial response and even exceed
65535 bytes, potentially leading to a crash resulting in denial of service
CVE-2026-27854: Denial of service when using DNSQuestion:getEDNSOptions method
in custom Lua code

-- 
You are receiving this mail because:
You are the assignee for the bug.