|
1 | | -c-ares version 1.18.1 |
| 1 | +c-ares version 1.19.1 |
2 | 2 |
|
3 | | -This is an urgent bugfix release for a regression made in 1.18.0. |
| 3 | +This is a security and bugfix release. |
4 | 4 |
|
5 | | -Bug fixes: |
6 | | - o ares_getaddrinfo() would return ai_addrlen of 16 for ipv6 |
7 | | - adddresses rather than the sizeof(struct sockaddr_in6) |
8 | | - |
9 | | - |
10 | | - |
11 | | -c-ares version 1.18.0 |
12 | | - |
13 | | -This is a feature and bugfix release. It addresses a couple of new feature |
14 | | -requests as well as a couple of bug fixes. |
| 5 | +A special thanks goes out to the Open Source Technology Improvement Fund |
| 6 | +(https://ostif.org) for sponsoring a security audit of c-ares performed by X41 |
| 7 | +(https://x41-dsec.de). |
15 | 8 |
|
16 | | -Changes: |
17 | | - o Add support for URI(Uniform Resource Identifier) records via |
18 | | - ares_parse_uri_reply() [1] |
19 | | - o Provide ares_nameser.h as a public interface as needed by NodeJS [5] |
20 | | - o Update URLs from c-ares.haxx.se to c-ares.org [9] |
21 | | - o During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so that the |
22 | | - search process will continue to the next domain in the search. [11] |
23 | | - o Turn ares_gethostbyname() into a wrapper for ares_getaddrinfo() as they |
24 | | - followed very similar code paths and ares_gethostbyaddr() has some more |
25 | | - desirable features such as priority sorting and parallel queries for |
26 | | - AF_UNSPEC. [12] |
27 | | - o ares_getaddrinfo() now contains a name element in the address info |
28 | | - structure as the last element. This is not an API or ABI break due to |
29 | | - the structure always being internally allocated and it being the last |
30 | | - element. [12] |
31 | | - o ares_parse_a_reply() and ares_parse_aaaa_reply() were nearly identical, those |
32 | | - now use the same helper functions for parsing rather than having their own |
33 | | - code. [12] |
34 | | - o RFC6761 Section 6.3 says "localhost" lookups need to be special cased to |
35 | | - return loopback addresses, and not forward queries to recursive dns servers. |
36 | | - On Windows this now returns all loopback addresses, on other systems it |
37 | | - returns 127.0.0.1 or ::1 always, and will never forward a request for |
38 | | - "localhost" to outside DNS servers. [13] |
39 | | - o Haiki: port [14] |
| 9 | +Security: |
| 10 | + o CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service [12] |
| 11 | + o CVE-2023-31147. Moderate. Insufficient randomness in generation of DNS |
| 12 | + query IDs [13] |
| 13 | + o CVE-2023-31130. Moderate. Buffer Underwrite in ares_inet_net_pton() [14] |
| 14 | + o CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE during cross |
| 15 | + compilation [15] |
40 | 16 |
|
41 | 17 | Bug fixes: |
42 | | - o add build to .gitignore [2] |
43 | | - o z/OS minor update, add missing semicolon in ares_init.c [3] |
44 | | - o Fix building when latest ax_code_coverage.m4 is imported [4] |
45 | | - o Work around autotools 'error: too many loops' and other newer autotools |
46 | | - import related bugs. |
47 | | - o MinGW cross builds need advapi32 link as lower case [6] |
48 | | - o Cygwin build fix due to containing both socket.h and winsock2.h [7] |
49 | | - o ares_expand_name should allow underscores (_) as SRV records legitimately use |
50 | | - them [8] |
51 | | - o Allow '/' as a valid character for a returned name for CNAME in-addr.arpa |
52 | | - delegation [10] |
53 | | - o ares_getaddrinfo() was not honoring HOSTALIASES [12] |
54 | | - o ares_getaddrinfo() had some test cases disabled due to a bug in the test |
55 | | - framework itself which has now been resolved [12] |
56 | | - o Due to Travis-CI becoming unfriendly to open-source, Cirrus-CI has now been |
57 | | - brought online for automated unit testing. |
| 18 | + o Fix uninitialized memory warning in test [1] |
| 19 | + o Turn off IPV6_V6ONLY on Windows to allow IPv4-mapped IPv6 addresses [2] |
| 20 | + o ares_getaddrinfo() should allow a port of 0 [3] |
| 21 | + o Fix memory leak in ares_send() on error [4] |
| 22 | + o Fix comment style in ares_data.h [5] |
| 23 | + o Remove unneeded ifdef for Windows [6] |
| 24 | + o Fix typo in ares_init_options.3 [7] |
| 25 | + o Re-add support for Watcom compiler [8] |
| 26 | + o Sync ax_pthread.m4 with upstream [9] |
| 27 | + o Windows: Invalid stack variable used out of scope for HOSTS path [10] |
| 28 | + o Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support [11] |
58 | 29 |
|
59 | 30 | Thanks go to these friendly people for their efforts and contributions: |
60 | | - Biswapriyo Nath (@Biswa96) |
61 | 31 | Brad House (@bradh352) |
62 | | - Daniel Bevenius (@danbev) |
| 32 | + @Chilledheart |
63 | 33 | Daniel Stenberg (@bagder) |
64 | | - Dhrumil Rana (@dhrumilrana) |
65 | | - Felix Yan (@felixonmars) |
66 | | - Jérôme Duval (@korli) |
67 | | - Martin Holeš (@martin-256) |
68 | | - Sinan Kaya |
| 34 | + Douglas R. Reno (@renodr) |
| 35 | + Gregor Jasny (@gjasny) |
| 36 | + Jay Freeman (@saurik) |
| 37 | + @lifenjoiner |
| 38 | + Nikolaos Chatzikonstantinou (@createyourpersonalaccount) |
| 39 | + Yijie Ma (@yijiem) |
69 | 40 | (9 contributors) |
70 | 41 |
|
71 | 42 | References to bug reports and discussions on issues: |
72 | | - [1] = https://github.com/c-ares/c-ares/pull/411 |
73 | | - [2] = https://github.com/c-ares/c-ares/pull/410 |
74 | | - [3] = https://github.com/c-ares/c-ares/pull/414 |
75 | | - [4] = https://github.com/c-ares/c-ares/pull/418 |
76 | | - [5] = https://github.com/c-ares/c-ares/pull/417 |
77 | | - [6] = https://github.com/c-ares/c-ares/pull/420 |
78 | | - [7] = https://github.com/c-ares/c-ares/pull/422 |
79 | | - [8] = https://github.com/c-ares/c-ares/issues/424 |
80 | | - [9] = https://github.com/c-ares/c-ares/issues/423 |
81 | | - [10] = https://github.com/c-ares/c-ares/issues/427 |
82 | | - [11] = https://github.com/c-ares/c-ares/issues/426 |
83 | | - [12] = https://github.com/c-ares/c-ares/pull/428 |
84 | | - [13] = https://github.com/c-ares/c-ares/pull/430 |
85 | | - [14] = https://github.com/c-ares/c-ares/pull/431 |
| 43 | + [1] = https://github.com/c-ares/c-ares/pull/515 |
| 44 | + [2] = https://github.com/c-ares/c-ares/pull/520 |
| 45 | + [3] = https://github.com/c-ares/c-ares/issues/517 |
| 46 | + [4] = https://github.com/c-ares/c-ares/pull/511 |
| 47 | + [5] = https://github.com/c-ares/c-ares/pull/513 |
| 48 | + [6] = https://github.com/c-ares/c-ares/pull/512 |
| 49 | + [7] = https://github.com/c-ares/c-ares/pull/510 |
| 50 | + [8] = https://github.com/c-ares/c-ares/pull/509 |
| 51 | + [9] = https://github.com/c-ares/c-ares/pull/507 |
| 52 | + [10] = https://github.com/c-ares/c-ares/pull/502 |
| 53 | + [11] = https://github.com/c-ares/c-ares/pull/505 |
| 54 | + [12] = https://github.com/c-ares/c-ares/security/advisories/GHSA-9g78-jv2r-p7vc |
| 55 | + [13] = https://github.com/c-ares/c-ares/security/advisories/GHSA-8r8p-23f3-64c2 |
| 56 | + [14] = https://github.com/c-ares/c-ares/security/advisories/GHSA-x6mf-cxr9-8q6v |
| 57 | + [15] = https://github.com/c-ares/c-ares/security/advisories/GHSA-54xr-f67r-4pc4 |
0 commit comments