Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

lists.thekelleys.org.uk

Post reply on HN
Print view View original

131–140 of 256 posts

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#131

Post by z3ratul163071 »

strenholme wrote: post #19

Shameless plug time: My own MaraDNS has been extensively audited now that we’re in the age of AI-assisted security audits. Not one single serious security bug has been found since 2023. [1] The only bugs auditers have been finding are things like “Deadwood, when fully recursive, will take longer than usual to release resources when getting this unusual packet” [2] or “This side utility included with MaraDNS, which ha…

good job. but it is amazing we are still writing core networking tools in vulnerable language such as c in 2026.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#132

Post by nullsanity »

x3n0ph3n3 wrote: post #105
unclejuan wrote: post #88

I think this is the breaking point where replacing our code written in C for code written in memory safe languages is becoming urgent. The vast majority of vulnerabilities found recently are directly related to being written in memory unsafe languages, it's very difficult to justify that a DNS/DHCP server can't be written in rust or go and without using unsafe (well, maybe a few unsafe calls are still needed, but the…

I disagree -- we're clearly getting better safeguards by way of AI agents to spot potential vulnerabilities!

[dead]

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#133

Post by fulafel »

zrm wrote: post #12
washingupliquid wrote: post #8

Maybe this is the kick in the ass Debian needs to upgrade the embarrassingly ancient dnsmasq in "stable" because while I can't think of any new features, the latest versions contain many non-CVE bug fixes. But I doubt it, they will lazily backport these patches to create some frankenstein one-off version and be done with it. Before anyone says "tHaT's wHaT sTaBlE iS fOr": they have literally shipped straight-up broke…

They're not going to put a newer version in stable. The way stable gets newer versions of things is that you get the newer version into testing and then every two years testing becomes stable and stable becomes oldstable, at which point the newer version from testing becomes the version in stable. The thing to complain about is if the version in testing is ancient.

Close: New versions go in unstable where development happens, testing is where things go to marinate for a while.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#134

Post by jabl »

x3n0ph3n3 wrote: post #105
unclejuan wrote: post #88

I think this is the breaking point where replacing our code written in C for code written in memory safe languages is becoming urgent. The vast majority of vulnerabilities found recently are directly related to being written in memory unsafe languages, it's very difficult to justify that a DNS/DHCP server can't be written in rust or go and without using unsafe (well, maybe a few unsafe calls are still needed, but the…

I disagree -- we're clearly getting better safeguards by way of AI agents to spot potential vulnerabilities!

The question is whether the current situation is a short burst of action, and once those most critical bugs get fixed the hype around AI vulnerability scanning will die down, or whether the current crop of system/infra software written in vulnerable languages like C are beyond redemption and they will provide an endless source of critical bugs for AI to find until we fix them by rewriting them in Rust/Go/whatever.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#136

Post by jabl »

washingupliquid wrote: post #96
koverstreet wrote: post #61

Earlier quoted context omitted.

If package maintainers were always fine upstanding package maintainers as you imagine them to be I wouldn't be complaining, but I have in fact had Debian ship my software and screw it up and gotten a flood of bug reports, so... :) I think you need to chill out. Relicensing the way you suggest would be _quite_ the hostile act, and I'm not going to that either. But I am an engineer, so of course I'm going to talk about…

[flagged]

The inevitable drama between Kent and Theo would melt the internet, for sure. Bring the popcorn.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#137

Post by BLKNSLVR »

romaniitedomum wrote: post #2

To quote a famous (in certain circles) bowl of petunias, "oh no, not again!"

For a number of reasons, I feel that the only way we got here was via some kind of infinite improbability drive.

(mostly unrelated to topic at hand though)

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#138

Post by ExoticPearTree »

washingupliquid wrote: post #8

Maybe this is the kick in the ass Debian needs to upgrade the embarrassingly ancient dnsmasq in "stable" because while I can't think of any new features, the latest versions contain many non-CVE bug fixes. But I doubt it, they will lazily backport these patches to create some frankenstein one-off version and be done with it. Before anyone says "tHaT's wHaT sTaBlE iS fOr": they have literally shipped straight-up broke…

About a decade ago I switched to Ubuntu LTS because of Debian’s “policy?” of having pretty old packages in “stable” and a long release cycles.

Nowadays, even with Ubuntu’s two year or so release cycle I have to use 3rd party packages to have up to date software (PHP being one) and not some version from three years ago.

We no longer live in a world (with few exceptions) where running a 3-5 year old distribution (still supported) makes sense.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#139

Post by yardstick »

jabl wrote: post #134
x3n0ph3n3 wrote: post #105

Earlier quoted context omitted.

I disagree -- we're clearly getting better safeguards by way of AI agents to spot potential vulnerabilities!

The question is whether the current situation is a short burst of action, and once those most critical bugs get fixed the hype around AI vulnerability scanning will die down, or whether the current crop of system/infra software written in vulnerable languages like C are beyond redemption and they will provide an endless source of critical bugs for AI to find until we fix them by rewriting them in Rust/Go/whatever.

An eternal summer of CVEs is upon us
Post reply on HN