WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-08-17 21:25:50 +02:00
Code Issues Packages Projects Releases Wiki Activity

- Fix in depth for serve-expired responses from cachedb, that it

Browse Source 
does not store bogus. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
This commit is contained in:
W.C.A. Wijngaards
2026-05-20 14:58:26 +02:00
parent b3aa262477
commit 9ce52de6c1
2 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cachedb/cachedb.c
+6
View File
@@ -401,6 +401,12 @@ prep_data(struct module_qstate* qstate, struct sldns_buffer* buf)
FLAGS_GET_RCODE(qstate->return_msg->rep->flags) != FLAGS_GET_RCODE(qstate->return_msg->rep->flags) !=
LDNS_RCODE_YXDOMAIN) LDNS_RCODE_YXDOMAIN)
return 0; return 0;
/* Do not persist data the validator has not yet seen, or has rejected.
* Otherwise an expired blob could maybe reach clients via
* serve-expired. */
if(qstate->env->need_to_validate &&
qstate->return_msg->rep->security == sec_status_bogus)
return 0;
/* We don't store the reply if its TTL is 0. This is probably coming /* We don't store the reply if its TTL is 0. This is probably coming
* from upstream and it is not meant to be stored. */ * from upstream and it is not meant to be stored. */
if(qstate->return_msg->rep->ttl == 0) if(qstate->return_msg->rep->ttl == 0)
doc/Changelog
+3
View File
@@ -35,6 +35,9 @@
- Unit test for CVE-2026-42959. - Unit test for CVE-2026-42959.
- Unit test for CVE-2026-40622. - Unit test for CVE-2026-40622.
- Unit test for CVE-2026-42960. - Unit test for CVE-2026-42960.
- Fix in depth for serve-expired responses from cachedb, that it
does not store bogus. Thanks to Qifan Zhang, Palo Alto Networks,
for the report.
18 May 2026: Wouter 18 May 2026: Wouter
- Fix for mixed class referrals, the resolver uses the query - Fix for mixed class referrals, the resolver uses the query