dnsmasq - Debian Package Tracker

general

source: dnsmasq (main)
version: 2.92~rc3-1
maintainer: Simon Kelley (DMD)
uploaders: Sven Geuer [DMD]
arch: all any
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.85-1
o-o-sec: 2.85-1+deb11u1
oldstable: 2.90-4~deb12u1
stable: 2.91-1
testing: 2.92~rc3-1
unstable: 2.92~rc3-1

versioned links

2.85-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.85-1+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.90-4~deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.91-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.92~rc3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

dnsmasq (35 bugs: 0, 27, 8, 0)
dnsmasq-base (3 bugs: 0, 1, 2, 0)
dnsmasq-base-lua
dnsmasq-utils (1 bugs: 0, 1, 0, 0)

action needed

Failed to analyze the VCS repository. Please troubleshoot and fix the issue. high

vcswatch reports that there is an error with this package's VCS, or the debian/changelog file inside it. Please check the error shown below and try to fix it. You might have to update the VCS URL in the debian/control file to point to the correct repository.

error: RPC failed; curl 28 Failed to connect to thekelleys.org.uk port 443 after 130658 ms: Couldn't connect to server fatal: the remote end hung up unexpectedly

Created: 2025-12-20 Last update: 2025-12-24 13:32

6 security issues in buster high

There are 6 open security issues in buster.

2 important issues:

CVE-2023-50387: Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
CVE-2023-50868: The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

4 issues postponed or untriaged:

CVE-2021-3448: (postponed; to be fixed through a stable update) A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ID to forge a reply and get it accepted by dnsmasq. This flaw makes a DNS Cache Poisoning attack much easier. The highest threat from this vulnerability is to data integrity.
CVE-2022-0934: (needs triaging) A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet processed by dnsmasq, potentially causing a denial of service.
CVE-2019-14834: (needs triaging) A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a denial of service (memory consumption) via vectors involving DHCP response creation.
CVE-2023-28450: (needs triaging) An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.

Created: 2024-02-13 Last update: 2024-06-29 13:15

2 bugs tagged patch in the BTS normal

The BTS contains patches fixing 2 bugs, consider including or untagging them.

Created: 2025-01-06 Last update: 2025-12-25 09:00

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2025-12-08 Last update: 2025-12-08 04:31

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.3 instead of 4.7.2).

Created: 2025-12-23 Last update: 2025-12-23 20:00

news

[rss feed]

[2025-12-12] dnsmasq 2.92~rc3-1 MIGRATED to testing (Debian testing watch)
[2025-12-07] Accepted dnsmasq 2.92~rc3-1 (source) into unstable (Sven Geuer)
[2025-12-04] Accepted dnsmasq 2.92~rc1-1 (source) into unstable (Sven Geuer)
[2025-03-23] dnsmasq 2.91-1 MIGRATED to testing (Debian testing watch)
[2025-03-20] Accepted dnsmasq 2.91-1 (source) into unstable (Sven Geuer)
[2025-01-29] dnsmasq 2.91~test9-1 MIGRATED to testing (Debian testing watch)
[2025-01-23] Accepted dnsmasq 2.91~test9-1 (source) into unstable (Sven Geuer)
[2025-01-15] dnsmasq 2.91~test6-1 MIGRATED to testing (Debian testing watch)
[2025-01-13] Accepted dnsmasq 2.91~test6-1 (source) into unstable (Sven Geuer)
[2025-01-04] Accepted dnsmasq 2.90-4~deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Mark Lee Garrett)
[2024-12-20] dnsmasq 2.90-7 MIGRATED to testing (Debian testing watch)
[2024-12-17] Accepted dnsmasq 2.90-7 (source) into unstable (Sven Geuer)
[2024-12-13] dnsmasq 2.90-6 MIGRATED to testing (Debian testing watch)
[2024-12-10] Accepted dnsmasq 2.90-6 (source) into unstable (Sven Geuer)
[2024-11-30] Accepted dnsmasq 2.80-1+deb10u3 (source) into oldoldstable (Lee Garrett) (signed by: Mark Lee Garrett)
[2024-11-29] Accepted dnsmasq 2.85-1+deb11u1 (source) into oldstable-security (Lee Garrett) (signed by: Mark Lee Garrett)
[2024-11-26] dnsmasq 2.90-5 MIGRATED to testing (Debian testing watch)
[2024-11-23] Accepted dnsmasq 2.90-5 (source) into unstable (Sven Geuer)
[2024-05-20] dnsmasq 2.90-4 MIGRATED to testing (Debian testing watch)
[2024-05-17] Accepted dnsmasq 2.90-4 (source) into unstable (Sven Geuer)
[2024-05-03] dnsmasq 2.90-3 MIGRATED to testing (Debian testing watch)
[2024-03-10] Accepted dnsmasq 2.90-3 (source) into unstable (Sven Geuer)
[2024-02-17] dnsmasq 2.90-2 MIGRATED to testing (Debian testing watch)
[2024-02-17] dnsmasq 2.90-2 MIGRATED to testing (Debian testing watch)
[2024-02-15] Accepted dnsmasq 2.90-2 (source) into unstable (Simon Kelley)
[2024-02-13] Accepted dnsmasq 2.90-1 (source) into unstable (Simon Kelley)
[2023-02-15] dnsmasq 2.89-1 MIGRATED to testing (Debian testing watch)
[2023-02-05] Accepted dnsmasq 2.89-1 (source) into unstable (Simon Kelley)
[2022-12-15] dnsmasq 2.88-1 MIGRATED to testing (Debian testing watch)
[2022-12-04] Accepted dnsmasq 2.88-1 (source) into unstable (Simon Kelley)

bugs [bug history graph]

all: 37 40
RC: 0
I&N: 27 30
M&W: 10
F&P: 0
patch: 2

links

homepage
lintian (0, 1)
buildd: logs, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
l10n (-, 42)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.92~rc3-1
32 bugs