Tue Feb 13 13:53:26 2024 UTC (103d)
Update net/unbound to version 1.19.1.

Pkgsrc changes:
 * none, other than checksums.

Upstream changes:
This security release fixes two DNSSEC validation vulnerabilities:
CVE-2023-50387 (referred here as the KeyTrap vulnerability) and
CVE-2023-50868 (referred here as the NSEC3 vulnerability).

The KeyTrap vulnerability works by using a combination of Keys
(also colliding Keys), Signatures and number of RRSETs on a malicious
zone.  Answers from that zone can force a DNSSEC validator down a
very CPU intensive and time costly validation path.

The NSEC3 vulnerability uses specially crafted responses on a
malicious zone with multiple NSEC3 RRSETs to force a DNSSEC validator
down a very CPU intensive and time costly NSEC3 hash calculation path.

Both can force Unbound to spend an enormous time (comparative to
regular traffic) validating a single specially crafted DNSSEC
response while everything else is on hold for that thread. A
trivially orchestrated attack could render all threads busy with
such responses leading to denial of service.

From version 1.19.1 on, Unbound introduces suspension on DNSSEC
response validations that seem to require more attempts than Unbound
is willing to make per response validation run. Suspension means
that Unbound will continue with other work before resuming a
suspended validation offering CPU time between validation resumptions
to other tasks. There is a backoff timer when suspending which is
further influenced by the number of suspends already used and the
amount of work currently in Unbound.

The introduced builtin limits in Unbound are:

- Max 4 DNSSEC key collissions are allowed when building chain of trust.
  More than that without a secure key treats the delegation as bogus.
- 8 validation attempts per RRSET (combination of keys + signatures).
  If more are needed and Unbound has yet to find a valid signature
  the RRSET is treated as bogus.
- More than 8 validation attempts per answer will suspend validation.
- 8 NSEC3 hash calculations are allowed before suspension. More than
  that will suspend validation.
- The limit of total suspensions is 16 after which the query will error
  out. Any completed RRSET validations populate the cache for use in
  future queries.

While under attack Unbound could show higher CPU load because of the
needed validations but the suspend strategy would guarantee the CPU is
not locked on any particular validation task.

We would like to thank Elias Heftrig, Haya Schulmann, Niklas Vogel,
and Michael Waidner from the German National Research Center for
Applied Cybersecurity ATHENE for discovering and responsibly
disclosing the KeyTrap vulnerability.

We would like to thank Petr Spacek from ISC for discovering and
responsibly disclosing the NSEC3 vulnerability.

Bug Fixes
- Fix CVE-2023-50387, DNSSEC verification complexity can be exploited to
  exhaust CPU resources and stall DNS resolvers.
- Fix CVE-2023-50868, NSEC3 closest encloser proof can exhaust CPU.


(he)
diff -r1.104 -r1.105 pkgsrc/net/unbound/Makefile
diff -r1.76 -r1.77 pkgsrc/net/unbound/distinfo

cvs diff -r1.104 -r1.105 pkgsrc/net/unbound/Makefile (expand / switch to unified diff)

--- pkgsrc/net/unbound/Makefile 2024/01/30 18:29:20 1.104
+++ pkgsrc/net/unbound/Makefile 2024/02/13 13:53:26 1.105
@@ -1,17 +1,16 @@ @@ -1,17 +1,16 @@
1# $NetBSD: Makefile,v 1.104 2024/01/30 18:29:20 adam Exp $ 1# $NetBSD: Makefile,v 1.105 2024/02/13 13:53:26 he Exp $
2 2
3DISTNAME= unbound-1.19.0 3DISTNAME= unbound-1.19.1
4PKGREVISION= 2 
5CATEGORIES= net 4CATEGORIES= net
6MASTER_SITES= https://nlnetlabs.nl/downloads/unbound/ 5MASTER_SITES= https://nlnetlabs.nl/downloads/unbound/
7 6
8MAINTAINER= pettai@NetBSD.org 7MAINTAINER= pettai@NetBSD.org
9HOMEPAGE= https://nlnetlabs.nl/projects/unbound/ 8HOMEPAGE= https://nlnetlabs.nl/projects/unbound/
10COMMENT= DNS resolver and recursive server 9COMMENT= DNS resolver and recursive server
11LICENSE= modified-bsd 10LICENSE= modified-bsd
12 11
13BUILD_DEFS+= VARBASE UNBOUND_USER UNBOUND_GROUP 12BUILD_DEFS+= VARBASE UNBOUND_USER UNBOUND_GROUP
14FILES_SUBST+= UNBOUND_USER=${UNBOUND_USER} UNBOUND_GROUP=${UNBOUND_GROUP} 13FILES_SUBST+= UNBOUND_USER=${UNBOUND_USER} UNBOUND_GROUP=${UNBOUND_GROUP}
15 14
16USE_LIBTOOL= yes 15USE_LIBTOOL= yes
17CONFIGURE_ARGS+= --enable-allsymbols 16CONFIGURE_ARGS+= --enable-allsymbols

cvs diff -r1.76 -r1.77 pkgsrc/net/unbound/distinfo (expand / switch to unified diff)

--- pkgsrc/net/unbound/distinfo 2023/11/09 14:20:53 1.76
+++ pkgsrc/net/unbound/distinfo 2024/02/13 13:53:26 1.77
@@ -1,6 +1,6 @@ @@ -1,6 +1,6 @@
1$NetBSD: distinfo,v 1.76 2023/11/09 14:20:53 he Exp $ 1$NetBSD: distinfo,v 1.77 2024/02/13 13:53:26 he Exp $
2 2
3BLAKE2s (unbound-1.19.0.tar.gz) = c43ad21e86e224c4fe8fc7590d9edcc5eb42e583876cb15bb6240d9d5ee71f82 3BLAKE2s (unbound-1.19.1.tar.gz) = 99c678716a6e80197f0dd5a51145aaeb39f15e46585f151eed364fd6eb8de89d
4SHA512 (unbound-1.19.0.tar.gz) = c7df997ab003d098f53ac97ffb4c8428ab28e24573ff21e21782cbeadca42edadeb5b0db53ce954c9ff3106a5edb36eb47109240c554a44d9aac75727b66aeb4 4SHA512 (unbound-1.19.1.tar.gz) = c81192b70f14a4e289cf738bf6b647cf25b58b1ab11076dee306ff25a530b6a1bbeca71cfa8820d80f48fd843019beb29a68796a1b1fcec6e561dfeccd62d96a
5Size (unbound-1.19.0.tar.gz) = 6336113 bytes 5Size (unbound-1.19.1.tar.gz) = 6340435 bytes
6SHA1 (patch-configure) = fe43ed9fdcfe12897e30f03833aec631d473529d 6SHA1 (patch-configure) = fe43ed9fdcfe12897e30f03833aec631d473529d