Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

net: Lookup functions may return invalid host names [1.15 backport] #46356

Closed
gopherbot opened this issue May 24, 2021 · 4 comments
Closed

net: Lookup functions may return invalid host names [1.15 backport] #46356

gopherbot opened this issue May 24, 2021 · 4 comments
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge release-blocker Security
Milestone
Go1.15.13

Comments

@gopherbot
Copy link
Contributor

@rolandshoemaker requested issue #46241 to be considered for backport to the next 1.15 minor release.

@gopherbot please consider this for backport to 1.15 and 1.16 as this is a security issue.
@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label May 24, 2021
@gopherbot gopherbot mentioned this issue May 24, 2021
Closed
@gopherbot gopherbot added this to the Go1.15.13 milestone May 24, 2021
@gopherbot
Copy link
Contributor Author

Change https://golang.org/cl/322231 mentions this issue: [release-branch.go1.15] net: verify results from Lookup* are valid domain names
@mknyszek
Copy link
Contributor

Since this appears to be a security issue with no apparent workaround, approved. (Also because the 1.16 backport was approved.)
@mknyszek mknyszek added CherryPickApproved Used during the release process for point releases and removed CherryPickCandidate Used during the release process for point releases labels May 25, 2021
@gopherbot
Copy link
Contributor Author

Change https://golang.org/cl/323269 mentions this issue: [release-branch.go1.15] net: verify results from Lookup* are valid domain names
gopherbot pushed a commit that referenced this issue May 27, 2021
@rolandshoemaker
[release-branch.go1.15] net: verify results from Lookup* are valid do…
31d60cd 
…main names

For the methods LookupCNAME, LookupSRV, LookupMX, LookupNS, and
LookupAddr check that the returned domain names are in fact valid DNS
names using the existing isDomainName function.

Thanks to Philipp Jeitner and Haya Shulman from Fraunhofer SIT for
reporting this issue.

Updates #46241
Fixes #46356
Fixes CVE-2021-33195

Change-Id: I47a4f58c031cb752f732e88bbdae7f819f0af4f3
Reviewed-on: https://go-review.googlesource.com/c/go/+/323131
Trust: Roland Shoemaker <roland@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
(cherry picked from commit cdcd028)
Reviewed-on: https://go-review.googlesource.com/c/go/+/323269
@gopherbot
Copy link
Contributor Author

Closed by merging 31d60cd to release-branch.go1.15.
@golang golang locked and limited conversation to collaborators May 27, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge release-blocker Security
3 participants
@FiloSottile @mknyszek @gopherbot