upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-28 04:34:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

CHANGES and release notes for CVE-2022-2881 [GL #3493]

Browse source 
(cherry picked from commit 430ee6c427)
This commit is contained in:
Evan Hunt 2022-08-16 16:26:02 -07:00 committed by Michał Kępień
parent 13333db69f
commit 2312c45ff2
2 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
CHANGES
View file

@ -1,3 +1,10 @@
5958. [security] When an HTTP connection was reused to get
statistics from the stats channel, and zlib
compression was in use, each successive
response sent larger and larger blocks of memory,
potentially reading past the end of the allocated
buffer. (CVE-2022-2881) [GL #3493]
5957. [security] Prevent excessive resource use while processing large
delegations. (CVE-2022-2795) [GL #3394]

5
doc/notes/notes-current.rst
View file

@ -24,6 +24,11 @@ Security Fixes
Bremler-Barr & Shani Stajnrod from Reichman University for bringing
this vulnerability to our attention. :gl:`#3394`
- When an HTTP connection was reused to request statistics from the
stats channel, the content length of successive responses could grow
in size past the end of the allocated buffer. This has been fixed.
(CVE-2022-2881) :gl:`#3493`
Known Issues
~~~~~~~~~~~~