Debian Package Tracker
Register | Log in
Subscribe

knot-resolver

caching, DNSSEC-validating DNS resolver

Choose email to subscribe with

general
  • source: knot-resolver (main)
  • version: 5.6.0-1
  • maintainer: knot-resolver packagers (DMD)
  • uploaders: Daniel Kahn Gillmor [DMD] – Ondřej Surý [DMD] – Santiago Ruano Rincón [DMD] – Jakub Ružička [DMD]
  • arch: all amd64 arm64 armel armhf i386 mips mips64el mipsel
  • std-ver: 4.6.0
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-bpo: 3.2.1-3~bpo9+1
  • oldstable: 3.2.1-3
  • old-sec: 3.2.1-3+deb10u1
  • stable: 5.3.1-1+deb11u1
  • testing: 5.6.0-1
  • unstable: 5.6.0-1
versioned links
  • 2.3.0-3~bpo9+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.2.1-3~bpo9+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.2.1-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.2.1-3+deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 5.3.1-1+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 5.6.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • knot-resolver (5 bugs: 0, 4, 1, 0)
  • knot-resolver-doc
  • knot-resolver-module-http (1 bugs: 0, 1, 0, 0)
action needed
5 security issues in buster high

There are 5 open security issues in buster.

1 important issue:
  • CVE-2023-26249: Knot Resolver before 5.6.0 enables attackers to consume its resources, launching amplification attacks and potentially causing a denial of service. Specifically, a single client query may lead to a hundred TCP connection attempts if a DNS server closes connections without providing a response.
4 issues postponed or untriaged:
  • CVE-2019-10190: (needs triaging) A vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers to bypass DNSSEC validation for non-existence answer. NXDOMAIN answer would get passed through to the client even if its DNSSEC validation failed, instead of sending a SERVFAIL packet. Caching is not affected by this particular bug but see CVE-2019-10191.
  • CVE-2019-10191: (needs triaging) A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secure domains to DNSSEC-insecure state, opening possibility of domain hijack using attacks against insecure DNS protocol.
  • CVE-2019-19331: (needs triaging) knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).
  • CVE-2020-12667: (needs triaging) Knot Resolver before 5.1.1 allows traffic amplification via a crafted DNS answer from an attacker-controlled server, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records.
Created: 2023-02-21 Last update: 2023-03-21 18:03
lintian reports 29 warnings high
Lintian reports 29 warnings about this package. You should make the package lintian clean getting rid of them.
Created: 2022-09-25 Last update: 2023-02-18 17:07
1 bug tagged patch in the BTS normal
The BTS contains patches fixing 1 bug, consider including or untagging them.
Created: 2022-12-16 Last update: 2023-03-26 16:32
2 low-priority security issues in bullseye low

There are 2 open security issues in bullseye.

2 issues left for the package maintainer to handle:
  • CVE-2022-40188: (needs triaging) Knot Resolver before 5.5.3 allows remote attackers to cause a denial of service (CPU consumption) because of algorithmic complexity. During an attack, an authoritative server must return large NS sets or address sets.
  • CVE-2023-26249: (needs triaging) Knot Resolver before 5.6.0 enables attackers to consume its resources, launching amplification attacks and potentially causing a denial of service. Specifically, a single client query may lead to a hundred TCP connection attempts if a DNS server closes connections without providing a response.

You can find information about how to handle these issues in the security team's documentation.

Created: 2022-09-22 Last update: 2023-03-21 18:03
Build log checks report 1 warning low
Build log checks report 1 warning
Created: 2020-02-28 Last update: 2020-02-28 17:07
Standards version of the package is outdated. wishlist
The package should be updated to follow the last version of Debian Policy (Standards-Version 4.6.2 instead of 4.6.0).
Created: 2022-05-11 Last update: 2023-01-27 07:55
news
[rss feed]
  • [2023-02-01] knot-resolver 5.6.0-1 MIGRATED to testing (Debian testing watch)
  • [2023-01-26] Accepted knot-resolver 5.6.0-1 (source) into unstable (Jakub Ružička)
  • [2022-10-07] Accepted knot-resolver 3.2.1-3+deb10u1 (source amd64 all) into oldstable (Chris Lamb)
  • [2022-09-27] knot-resolver 5.5.3-1 MIGRATED to testing (Debian testing watch)
  • [2022-09-22] Accepted knot-resolver 5.5.3-1 (source) into unstable (Jakub Ružička)
  • [2022-09-11] knot-resolver 5.5.2-1 MIGRATED to testing (Debian testing watch)
  • [2022-09-04] Accepted knot-resolver 5.5.2-1 (source) into unstable (Jakub Ružička)
  • [2022-08-05] Accepted knot-resolver 5.5.1-5 (source) into unstable (Jakub Ružička)
  • [2022-08-02] Accepted knot-resolver 5.5.1-4 (source) into unstable (Jakub Ružička)
  • [2022-07-27] Accepted knot-resolver 5.5.1-3 (source) into unstable (Jakub Ružička)
  • [2022-07-03] Accepted knot-resolver 5.3.1-1+deb11u1 (source) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Jakub Ružička)
  • [2022-07-03] Accepted knot-resolver 5.5.1-2 (source) into experimental (Jakub Ružička)
  • [2022-06-14] Accepted knot-resolver 5.5.1-1 (source) into unstable (Jakub Ružička)
  • [2022-03-17] Accepted knot-resolver 5.5.0-1 (source) into unstable (Jakub Ružička)
  • [2022-03-16] knot-resolver REMOVED from testing (Debian testing watch)
  • [2022-01-08] knot-resolver 5.4.4-1 MIGRATED to testing (Debian testing watch)
  • [2022-01-05] Accepted knot-resolver 5.4.4-1 (source) into unstable (Jakub Ružička)
  • [2021-12-04] knot-resolver 5.4.3-1 MIGRATED to testing (Debian testing watch)
  • [2021-12-01] Accepted knot-resolver 5.4.3-1 (source) into unstable (Jakub Ružička)
  • [2021-10-21] knot-resolver 5.4.2-1 MIGRATED to testing (Debian testing watch)
  • [2021-10-18] Accepted knot-resolver 5.4.2-1 (source) into unstable (Jakub Ružička)
  • [2021-09-08] knot-resolver 5.4.1-2 MIGRATED to testing (Debian testing watch)
  • [2021-09-06] Accepted knot-resolver 5.4.1-2 (source) into unstable (Jakub Ružička)
  • [2021-08-26] Accepted knot-resolver 5.4.1-1 (source amd64 all) into experimental (Jakub Ružička)
  • [2021-05-02] knot-resolver 5.3.1-1 MIGRATED to testing (Debian testing watch)
  • [2021-04-12] Accepted knot-resolver 5.3.1-1 (source) into unstable (Santiago Ruano Rincón)
  • [2021-03-03] Accepted knot-resolver 5.3.0-1 (source) into unstable (Jakub Ružička) (signed by: Santiago Ruano Rincón)
  • [2021-01-06] knot-resolver 5.2.1-1 MIGRATED to testing (Debian testing watch)
  • [2020-12-15] Accepted knot-resolver 5.2.1-1 (source) into unstable (Santiago Ruano Rincón)
  • [2020-12-07] Accepted knot-resolver 5.2.0-2 (source) into unstable (Santiago Ruano Rincón)
  • 1
  • 2
bugs [bug history graph]
  • all: 10
  • RC: 0
  • I&N: 8
  • M&W: 1
  • F&P: 1
  • patch: 1
links
  • homepage
  • lintian (0, 29)
  • buildd: logs, checks, reproducibility, cross
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • screenshots
  • l10n (100, -)
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 5.6.0-1
  • 6 bugs

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing