Fedora 27: knot-resolver Security Update
Summary
The Knot DNS Resolver is a caching full resolver implementation written in C
and LuaJIT, including both a resolver library and a daemon. Modular
architecture of the library keeps the core tiny and efficient, and provides
a state-machine like API for extensions.
The package is pre-configured as local caching resolver.
To start using it, start a single kresd instance:
If you run into issues with activation of the service or its sockets, either
update your selinux-policy package or turn off selinux (setenforce 0).
https://bugzilla.redhat.com/show_bug.cgi?id=1366968
https://bugzilla.redhat.com/show_bug.cgi?id=1543049
Knot Resolver 2.1.0 (2018-02-16) ================================ Incompatible
changes -------------------- - stats: remove tracking of expiring records
(predict uses another way) - systemd: re-use a single kresd.socket and kresd-tls.socket - ta_sentinel: implement protocol draft-ietf-dnsop-kskroll-sentinel-01 (our draft-ietf-dnsop-kskroll-sentinel-00 implementation had
inverted logic) - libknot: require version 2.6.4 or newer to get bugfixes for
DNS-over-TLS Bugfixes -------- - detect_time_jump module: don't clear cache on
suspend-resume (#284) - stats module: fix stats.list() returning nothing,
regressed in 2.0.0 - policy.TLS_FORWARD: refusal when configuring with multiple
IPs (#306) - cache: fix broken refresh of insecure records that were about to
expire - fix the hints module on some systems, e.g. Fedora (came back on 2.0.0)
- build with older gnutls (conditionally disable features) - fix the predict
module to work with insecure records & cleanup code Knot Resolver 2.0.0
(2018-01-31) ================================ Incompatible changes
-------------------- - systemd: change unit files to allow running multiple
instances, deployments with single instance now must use `kresd@1.service`
instead of `kresd.service`; see kresd.systemd(7) for details - systemd: the
directory for cache is now /var/cache/knot-resolver - unify default directory
and user to `knot-resolver` - directory with trust anchor file specified by -k
option must be writeable - policy module is now loaded by default to enforce RFC
6761; see documentation for policy.PASS if you use locally-served DNS zones -drop support for alternative cache backends memcached, redis, and for Lua
bindings for some specific cache operations - REORDER_RR option is not
implemented (temporarily) New features ------------ - aggressive caching of
validated records (RFC 8198) for NSEC zones; thanks to ICANN for sponsoring
this work. - forwarding over TLS, authenticated by SPKI pin or certificate.
policy.TLS_FORWARD pipelines queries out-of-order over shared TLS connection
Beware: Some resolvers do not support out-of-order query processing. TLS
forwarding to such resolvers will lead to slower resolution or failures. - trust
anchors: you may specify a read-only file via -K or --keyfile-ro - trust
anchors: at build-time you may set KEYFILE_DEFAULT (read-only) - ta_sentinel
module implements draft ietf-dnsop-kskroll-sentinel-00, enabled by default -serve_stale module is prototype, subject to change - extended API for Lua
modules Bugfixes -------- - fix build on osx - regressed in 1.5.3 (different
linker option name) ---- Knot Resolver 1.5.3 (2018-01-23)
================================ Bugfixes -------- - fix the hints module on
some systems, e.g. Fedora. Symptom: `undefined symbol: engine_hint_root_file`
Knot Resolver 1.5.2 (2018-01-22) ================================ Security
-------- - fix CVE-2018-1000002: insufficient DNSSEC validation, allowing
attackers to deny existence of some data by forging packets. Some combinations
pointed out in RFC 6840 sections 4.1 and 4.3 were not taken into account.
Bugfixes -------- - memcached: fix fallout from module rename in 1.5.1 Knot
Resolver 1.5.1 (2017-12-12) ================================ Incompatible
changes -------------------- - script supervisor.py was removed, please migrate
to a real process manager - module ketcd was renamed to etcd for consistency -module kmemcached was renamed to memcached for consistency Bugfixes -------- -fix SIGPIPE crashes (#271) - tests: work around out-of-space for platforms with
larger memory pages - lua: fix mistakes in bindings affecting 1.4.0 and 1.5.0
(and 1.99.1-alpha), potentially causing problems in dns64 and workarounds
modules - predict module: various fixes (!399) Improvements ------------ - add
priming module to implement RFC 8109, enabled by default (#220) - add modules
helping with system time problems, enabled by default; for details see
documentation of detect_time_skew and detect_time_jump
[ 1 ] Bug #1537462 - CVE-2018-1000002 knot-resolver: Insufficient DNSSEC validation
https://bugzilla.redhat.com/show_bug.cgi?id=1537462
su -c 'dnf upgrade knot-resolver' at the command line.
For more information, refer to the dnf documentation available at
https://dnf.readthedocs.io/en/latest/command_ref.html
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/security/
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
FEDORA-2018-fe5a6ed3b7 2018-02-27 17:16:42.082266 Product : Fedora 27 Version : 2.1.0 Release : 1.fc27 URL : https://www.knot-resolver.cz/ Summary : Caching full DNS Resolver Description : The Knot DNS Resolver is a caching full resolver implementation written in C and LuaJIT, including both a resolver library and a daemon. Modular architecture of the library keeps the core tiny and efficient, and provides a state-machine like API for extensions. The package is pre-configured as local caching resolver. To start using it, start a single kresd instance: If you run into issues with activation of the service or its sockets, either update your selinux-policy package or turn off selinux (setenforce 0). https://bugzilla.redhat.com/show_bug.cgi?id=1366968 https://bugzilla.redhat.com/show_bug.cgi?id=1543049 Knot Resolver 2.1.0 (2018-02-16) ================================ Incompatible changes -------------------- - stats: remove tracking of expiring records (predict uses another way) - systemd: re-use a single kresd.socket and kresd-tls.socket - ta_sentinel: implement protocol draft-ietf-dnsop-kskroll-sentinel-01 (our draft-ietf-dnsop-kskroll-sentinel-00 implementation had inverted logic) - libknot: require version 2.6.4 or newer to get bugfixes for DNS-over-TLS Bugfixes -------- - detect_time_jump module: don't clear cache on suspend-resume (#284) - stats module: fix stats.list() returning nothing, regressed in 2.0.0 - policy.TLS_FORWARD: refusal when configuring with multiple IPs (#306) - cache: fix broken refresh of insecure records that were about to expire - fix the hints module on some systems, e.g. Fedora (came back on 2.0.0) - build with older gnutls (conditionally disable features) - fix the predict module to work with insecure records & cleanup code Knot Resolver 2.0.0 (2018-01-31) ================================ Incompatible changes -------------------- - systemd: change unit files to allow running multiple instances, deployments with single instance now must use `kresd@1.service` instead of `kresd.service`; see kresd.systemd(7) for details - systemd: the directory for cache is now /var/cache/knot-resolver - unify default directory and user to `knot-resolver` - directory with trust anchor file specified by -k option must be writeable - policy module is now loaded by default to enforce RFC 6761; see documentation for policy.PASS if you use locally-served DNS zones -drop support for alternative cache backends memcached, redis, and for Lua bindings for some specific cache operations - REORDER_RR option is not implemented (temporarily) New features ------------ - aggressive caching of validated records (RFC 8198) for NSEC zones; thanks to ICANN for sponsoring this work. - forwarding over TLS, authenticated by SPKI pin or certificate. policy.TLS_FORWARD pipelines queries out-of-order over shared TLS connection Beware: Some resolvers do not support out-of-order query processing. TLS forwarding to such resolvers will lead to slower resolution or failures. - trust anchors: you may specify a read-only file via -K or --keyfile-ro - trust anchors: at build-time you may set KEYFILE_DEFAULT (read-only) - ta_sentinel module implements draft ietf-dnsop-kskroll-sentinel-00, enabled by default -serve_stale module is prototype, subject to change - extended API for Lua modules Bugfixes -------- - fix build on osx - regressed in 1.5.3 (different linker option name) ---- Knot Resolver 1.5.3 (2018-01-23) ================================ Bugfixes -------- - fix the hints module on some systems, e.g. Fedora. Symptom: `undefined symbol: engine_hint_root_file` Knot Resolver 1.5.2 (2018-01-22) ================================ Security -------- - fix CVE-2018-1000002: insufficient DNSSEC validation, allowing attackers to deny existence of some data by forging packets. Some combinations pointed out in RFC 6840 sections 4.1 and 4.3 were not taken into account. Bugfixes -------- - memcached: fix fallout from module rename in 1.5.1 Knot Resolver 1.5.1 (2017-12-12) ================================ Incompatible changes -------------------- - script supervisor.py was removed, please migrate to a real process manager - module ketcd was renamed to etcd for consistency -module kmemcached was renamed to memcached for consistency Bugfixes -------- -fix SIGPIPE crashes (#271) - tests: work around out-of-space for platforms with larger memory pages - lua: fix mistakes in bindings affecting 1.4.0 and 1.5.0 (and 1.99.1-alpha), potentially causing problems in dns64 and workarounds modules - predict module: various fixes (!399) Improvements ------------ - add priming module to implement RFC 8109, enabled by default (#220) - add modules helping with system time problems, enabled by default; for details see documentation of detect_time_skew and detect_time_jump [ 1 ] Bug #1537462 - CVE-2018-1000002 knot-resolver: Insufficient DNSSEC validation https://bugzilla.redhat.com/show_bug.cgi?id=1537462 su -c 'dnf upgrade knot-resolver' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ package-announce mailing list -- package-announce@lists.fedoraproject.org To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Change Log
References
Update Instructions
