Bug 29776 - ldns new security issues rhbz#2028468, rhbz#2028465, rhbz#2028472 (CVE-2020-19860, CVE-2020-19861)
Summary: ldns new security issues rhbz#2028468, rhbz#2028465, rhbz#2028472 (CVE-2020-1...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2021-12-17 19:40 CET by David Walser
Modified: 2022-02-01 18:05 CET (History)
7 users (show)

See Also:
Source RPM: ldns-1.7.1-3.mga9.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2021-12-17 19:40:21 CET 
Fedora has issued an advisory today (December 17):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2X73FZHU3TMEVLPJ6AFGATNWWADHGZW3/

The issues are fixed upstream in 1.8.0 (Fedora updated to 1.8.1).

Mageia 8 is also affected.
David Walser 2021-12-17 19:40:43 CET

Status comment: (none) => Fixed upstream in 1.8.0
CC: (none) => geiger.david68210, guillomovitch
Whiteboard: (none) => MGA8TOO

Comment 1 Nicolas Lécureuil 2021-12-17 22:30:22 CET 
updated in cauldron.

Version: Cauldron => 8
CC: (none) => mageia
Whiteboard: MGA8TOO => (none)

Comment 2 Nicolas Lécureuil 2021-12-17 22:31:49 CET 
new version pushed in mga8

src:
    - ldns-1.8.1-1.mga8

Assignee: bugsquad => qa-bugs

Comment 3 David Walser 2021-12-17 22:36:18 CET 
python3-ldns-1.8.1-1.mga8
libldns-devel-1.8.1-1.mga8
libldns3-1.8.1-1.mga8
ldns-utils-1.8.1-1.mga8

from ldns-1.8.1-1.mga8.src.rpm

Status comment: Fixed upstream in 1.8.0 => (none)

Comment 4 Herman Viaene 2021-12-20 14:28:52 CET 
MGA8-64 Plasma on Lenovo B50 in Dutch
No installation issues
Ref bug 13324 for testing
$ mkdir testldns
$ cd testldns
$ ldns-keygen -a RSASHA1_NSEC3 -b 1024 example.net
Kexample.net.+007+03893
$ ll
totaal 8
-rw-r--r-- 1 tester8 tester8 241 dec 20 14:19 Kexample.net.+007+03893.key
-rw------- 1 tester8 tester8 943 dec 20 14:19 Kexample.net.+007+03893.private
$ urpmf ldns-utils | grep bin
ldns-utils:/usr/bin/drill
ldns-utils:/usr/bin/ldns-chaos
ldns-utils:/usr/bin/ldns-compare-zones
ldns-utils:/usr/bin/ldns-dane
ldns-utils:/usr/bin/ldns-dpa
etc....

$ ldns-mx mageia.org                                   
mageia.org.     1800    IN      MX      10 sucuk.mageia.org.
mageia.org.     1800    IN      MX      20 neru.mageia.org.
$ drill mageia.org @8.8.8.8
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 11653
;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; mageia.org.  IN      A

;; ANSWER SECTION:
mageia.org.     1800    IN      A       163.172.148.228

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 2155 msec
;; SERVER: 8.8.8.8
;; WHEN: Mon Dec 20 14:21:44 2021
;; MSG SIZE  rcvd: 44

If Claire OK'ed this on these tests, I'll follow her.

Whiteboard: (none) => MGA8-64-OK
CC: (none) => herman.viaene

Comment 5 Thomas Andrews 2021-12-20 18:48:10 CET 
If I learned anything in my early days with QA, it was "don't argue with Claire." ;-)

Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Dave Hodgins 2021-12-23 19:59:04 CET

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 6 Mageia Robot 2021-12-23 22:03:05 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0582.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED

Comment 7 David Walser 2022-02-01 18:05:27 CET 
rhbz#2028468 is CVE-2020-19861, and CVE-2020-19860 was also fixed in 1.8.0 and in this update:
https://bugzilla.redhat.com/show_bug.cgi?id=2044427
https://ubuntu.com/security/notices/USN-5257-1

Summary: ldns new security issues rhbz#2028468, rhbz#2028465, rhbz#2028472 => ldns new security issues rhbz#2028468, rhbz#2028465, rhbz#2028472 (CVE-2020-19860, CVE-2020-19861)
Note You need to log in before you can comment on or make changes to this bug.