Bug 1525876
| Summary: | Google Security Blog found vulnerabilities former to version 2.78. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | ricky.tigg |
| Component: | dnsmasq | Assignee: | Petr Menšík <pemensik> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 27 | CC: | code, dougsland, dustymabe, itamar, jima, laine, p, pemensik, thozza, veillard |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | All | ||
| Whiteboard: | |||
| Fixed In Version: | dnsmasq-2.78-1.fc27 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-12-19 19:51:15 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
It is not true we offer vulnerable version of dnsmasq. If you check change log, all security vulnerabilities are fixed by downstream patches. These fixes are there, current version is NOT vulnerable. New version is already offered in rawhide, but both should be equally secure. Tough the same build as rawhide can be use for F27 as well. It offers no greater security, just higher version. dnsmasq-2.78-1.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2017-4f77158a69 dnsmasq-2.78-1.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-4f77158a69 Following the instructions mentioned in document from the link provided in Comment 3, the output from the command $ sudo dnf install -y dnsmasq --enablerepo=updates-testing is: Package dnsmasq-2.77-9.fc27.x86_64 is already installed, skipping. As a result the component installed remains the one from the Fedora 27 updates repository. dnsmasq-2.78-1.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: It is noticeable that regarding DNS vulnerabilities found (CVE-2017-{14491-14496} specifically categorized as security issues, and CVE-2017-13704) and publicized on October 2, 2017 on the Google Security Blog (https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html), respective patches have been committed as illustrated on http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=summary, and are implemented in the version 2.78 as the statement suggests: «Users who have deployed the latest version of Dnsmasq (2.78) will be protected from the attacks discovered here.» Version-Release number of selected component (if applicable): dnsmasq-2.77-9.fc27.x86_64 Actual results: Fedora makes available tu public a component not up to date on its Updates repository, and consequently using any version former to 2.78 is unsafe. Expected results: At least version 2.78 to be made available on repository. Additional info: Regarding issue CVE-2017-14491, no less than two security fixes have been committed in a short laps time, which may be interpreted generally as some of the committed patches may not have a persistent effect against the vulnerabilities they tended to fix along with the releases of the firsts security patches, and suggests that despite security fixes have been committed, in the cases they are unique to a specific issue, they may not have accomplished entirely their goals.