[Bug 296232] dns/ldns Update to 1.0.2

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296232

            Bug ID: 296232
           Summary: dns/ldns Update to 1.0.2
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
               URL: https://community.nlnetlabs.nl/t/ldns-1-9-2-released/3
                    404
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: Individual Port(s)
          Assignee: ports-bugs@FreeBSD.org
          Reporter: jaap@NLnetLabs.nl
 Attachment #272071 maintainer-approval+
             Flags:

Created attachment 272071
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=272071&action=edit
patch to upgrade

NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in
applications as (stub) resolver over UDP, lacks matching the query destination
address and port with the response source address and port. Furthermore not the
query ID, neither the question of the query is matched with that of the
response. This makes applications, that use ldns for (stub) resolver
functionality, vulnerable for off-path poisoning attacks.

The drill tool, which is shipped with ldns and uses ldns for stub resolving,
inherently suffers from this vulnerability too.

Please do not install ldns version 1.9.1 as it has a wrong .so version. Install
ldns version 1.9.2 instead.

-- 
You are receiving this mail because:
You are the assignee for the bug.