Date: Tue, 23 Feb 2021 14:58:51 +0000 From: bugzilla-noreply@freebsd.org To: ports-bugs@FreeBSD.org Subject: [Bug 253795] dns/opendnssec2: Update to 2.1.8 Message-ID: <bug-253795-7788@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D253795 Bug ID: 253795 Summary: dns/opendnssec2: Update to 2.1.8 Product: Ports & Packages Version: Latest Hardware: Any URL: https://www.opendnssec.org/2021/02/opendnssec-2-1-8/ OS: Any Status: New Severity: Affects Some People Priority: --- Component: Individual Port(s) Assignee: ports-bugs@FreeBSD.org Reporter: jaap@NLnetLabs.nl Attachment #222758 maintainer-approval+ Flags: Created attachment 222758 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D222758&action= =3Dedit patch to upgrade The port itself incorporates fixes for the issue signalled in PR #253536 This release of 2.1.8 fixes a number of bugs related to the purging of keys, a potential denial of service vulnerability in some installations, and a few rarer but nasty potential crashes. Earlier versions of OpenDNSSEC 2.1 might not have all keys purged from the HSM if instructed to do so. Since this is now done automatically this is worth pointing out that this was a bug and old keys will be permanently removed from the HSM. Either when manually purging keys, or having specified a <Purge> in your key policy (kasp.xml), the keys are supposed to be removed from the HSM. However, for some time, the keys were marked for deletion, and became invisible, but the removal from the HSM was skipped. In this release candidate this is fixed, but still allowing keys not to be removed entirely. When you specify an automatic purge then the keys will, after the specified period, will be completely removed. When you purge manually, keys are not removed from the HSM unless you specify an additional flag (the --delete or -d flag). Special thanks to the people that help us in making OpenDNSSEC better and better, mentioned in the NEWS file as always. Two of the bugs were only traceable using this help. Issues: * OPENDNSSEC-954: Upgrade autoconf/automake configuration chain for version 2.69/1.16.2. * SUPPORT-261: Fix to crash when using ods-enforcer set-policy command. * OPENDNSSEC-953: Fix to crash in case zone file not present while getting a signconf update and state flush command. Thanks to Stefan Ubbink from SIDN for the co-operation in this fix. * OPENDNSSEC-951: Modify the purging of keys, to make it automatic to purge keys from the HSM. Thanks to Stefan Ubbink from SIDN for the co-operation in this fix. * OPENDNSSEC-950: Fix that caused crash when signer was offline for a prolonged period (but the enforcer wasn't) in the middle of a ZSK roll. * OPENDNSSEC-952: memory leak in when receiving NOTIFY for non-existent zone Thanks S=C3=A9bastien Tisserant to for reporting). --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-253795-7788>