Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

lists.thekelleys.org.uk

Post reply on HN
Print view View original

91–100 of 256 posts

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#91

Post by zie »

ryandrake wrote: post #78
zie wrote: post #42

Earlier quoted context omitted.

Clearly you disagree with the debian stable perspective. That's fine, it's not for everyone. You can just run debian unstable or debian testing, depending on where exactly you draw the line. If you want the rolling release like distro, just run debian unstable. That's what you get. It's on par with all the other constantly updated distros out there. Or just run one of those. Also, Debian stable has a lifetime a lot l…

...or just leave grandparents on the previous version of Stable until they get a new computer. Honestly not a huge fan of upgrading software at all, if I'm the one supporting the machines.

Just depends on if that's something grandparents/kids can/want to afford.

Personally, If the hardware is working great, seems like a waste of money replacing it, just to upgrade software. Especially with Debian oldstable -> Debian stable where it's usually quite easy and painless.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#92

Post by washingupliquid »

zrm wrote: post #40
koverstreet wrote: post #33

Earlier quoted context omitted.

You're going to have to update production at some point, and delaying it to once every 2 years is just deferred maintenance. And you know what they say about that... So when you do update and get that GSSAPI change, it comes with two years worth of other updates - and tracking that down mixed in with everything else is going to be all kinds of fun. And if you're two years out of the loop and it turns out upstream bro…

There are two different kinds of updates. One is security updates and bug fixes. These need to fix the problem with the smallest change to minimize the amount of possible breakage, because the code is already vulnerable/broken in production and needs to be updated right now . These are the updates stable gets. The other is changes and additions. They're both more likely to break things and less important to move into…

> One is security updates and bug fixes.

That's where you're wrong. They're not one and the same.

Debian stable often defers non-security bug fixes for up to two years by playing this game.

I'm not interested in new features unless they make things actually work.

Debian stable time and again favors broken over new. Broken kernels, broken packages. At least they're stable in their brokenness.

Hence my complaint.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#93

Post by lmm »

washingupliquid wrote: post #8

Maybe this is the kick in the ass Debian needs to upgrade the embarrassingly ancient dnsmasq in "stable" because while I can't think of any new features, the latest versions contain many non-CVE bug fixes. But I doubt it, they will lazily backport these patches to create some frankenstein one-off version and be done with it. Before anyone says "tHaT's wHaT sTaBlE iS fOr": they have literally shipped straight-up broke…

That's what stable is for though. Like, sure, stable's policy is ludicrous and you would have to be insane to run stable. But the remedy for that isn't to try to change Debian policy, it's to get people to stop running stable. Maybe once no-one uses it Debian will see sense.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#94

Post by andrewjf »

gcr wrote: post #83
strenholme wrote: post #19

Shameless plug time: My own MaraDNS has been extensively audited now that we’re in the age of AI-assisted security audits. Not one single serious security bug has been found since 2023. [1] The only bugs auditers have been finding are things like “Deadwood, when fully recursive, will take longer than usual to release resources when getting this unusual packet” [2] or “This side utility included with MaraDNS, which ha…

MaraDNS is much less popular than dnsmasq though. I have several libraries that I've written. Not one single serious security bug in them has been found since 1991. Granted, nobody uses my libraries... Not to diminish your team's achievement! :D But it's important to contextualize claims like this with information about what your userbase looks like

I don't think that's relevant. You can still find security issues in software nobody uses.

The question is a matter of impact because of how used the software is.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#95

Post by selectively »

shakna wrote: post #90
theamk wrote: post #84

Earlier quoted context omitted.

Unless the service accepts Lua code from the internet (and that would be a completely insane thing), the CVE-2014-5461 will not apply. And while I have not reviewed every Lua CVE, I bet most (all?) of then require a specifically crafted code, or at least highly-complex user input (such as arbitrary json) It's important to look at the actual vulnerability at the context, and not just list any CVE which matches by vers…

Its important to maintain your dependencies, by say embedding Lua, rather than rebranding it and then claiming you have no security flaws. If I can find a CVE that _may_ affect the stack in five minutes, what _actual_ problems lurk there? You vendor Lua - thus, it _is_ your responsibility to review every Lua CVE. You've set yourself up as the maintainer by vendoring.

[flagged]

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#96

Post by washingupliquid »

koverstreet wrote: post #61
rlpb wrote: post #51

Earlier quoted context omitted.

> ...upstream package maintainers who are expected to deal with bug reports from ancient versions... They are not expected to deal with this. This is the responsibility of the Debian package maintainer. If you (as an upstream) licensed your software in a manner that allows Debian to do what it does, and they do this to serve their users who actually want that, you are wrong to then complain about it. If you don't wan…

If package maintainers were always fine upstanding package maintainers as you imagine them to be I wouldn't be complaining, but I have in fact had Debian ship my software and screw it up and gotten a flood of bug reports, so... :) I think you need to chill out. Relicensing the way you suggest would be _quite_ the hostile act, and I'm not going to that either. But I am an engineer, so of course I'm going to talk about…

[flagged]

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#98

Post by ajross »

theamk wrote: post #84
shakna wrote: post #66

Earlier quoted context omitted.

Well, as you bundle Lua 5.1 (as Lunacy), instead of making a library and loading it, and you bundled the 2012 version, you're probably affected by CVE-2014-5461 and others. Lua hasn't been security fix free.

Unless the service accepts Lua code from the internet (and that would be a completely insane thing), the CVE-2014-5461 will not apply. And while I have not reviewed every Lua CVE, I bet most (all?) of then require a specifically crafted code, or at least highly-complex user input (such as arbitrary json) It's important to look at the actual vulnerability at the context, and not just list any CVE which matches by vers…

That seems wildly naive in the post-XSS era. We've been here before, and that kind of analysis turns out to be wrong almost every time.

"Well, sure, this component is insecure but an attacker can't reach it" is like a 50%+ positive signal for an unexpected privilege elevation bug.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#99

Post by TacticalCoder »

washingupliquid wrote: post #8

Maybe this is the kick in the ass Debian needs to upgrade the embarrassingly ancient dnsmasq in "stable" because while I can't think of any new features, the latest versions contain many non-CVE bug fixes. But I doubt it, they will lazily backport these patches to create some frankenstein one-off version and be done with it. Before anyone says "tHaT's wHaT sTaBlE iS fOr": they have literally shipped straight-up broke…

    https://security-tracker.debian.org/tracker/CVE-2026-2291
    https://security-tracker.debian.org/tracker/CVE-2026-4890
    https://security-tracker.debian.org/tracker/CVE-2026-4891
    https://security-tracker.debian.org/tracker/CVE-2026-4892
    https://security-tracker.debian.org/tracker/CVE-2026-4893
    https://security-tracker.debian.org/tracker/CVE-2026-5172
fixed, fixed, fixed, fixed, fixed and fixed

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#100

Post by shermantanktop »

rgkpz wrote: post #45
binaryturtle wrote: post #43

Earlier quoted context omitted.

That's a bit shameless, indeed. dnsmasq has served me well for like an eternity in multiple setups for different use cases. As all software it has bugs. And once located those get fixed. Its author is also easy to communicate with. Why should I switch over to something way less proven? I'm quite sure your software also has bugs, many still not located. Maybe because it's less popular/ less well known nobody cares to…

"All software has bugs" is the most meaningless statement ever. It is just used for bonding with fellow bug writers who sit at a virtual campfire and muse about inevitabilities. Demonstrably some software has fewer bugs, and its authors are often hated, especially if they are a lone author like Bernstein. Because it must not happen! Projects with useless churn and many bug reports are more popular because only activi…

“Fellow bug writers” is everyone. People who write fewer bugs exist, and a lone few who write many fewer.

I haven’t noticed antipathy, but I have noticed skepticism. I assume people with outlier records in any field get some extra inspection.

If it becomes jealousy-fueled not-picking, those people are insecure jerks. But unusual track records are worth understanding.

Post reply on HN