«
»

OpenDNSSEC 2.1.8

Version 2.1.8 of OpenDNSSEC has been released on 2020-02-20.

News

This release of 2.1.8 fixes a number of bugs related to the purging of keys, a potential denial of service vulnerability in some installations, and a few rarer but nasty potential crashes. Earlier versions of OpenDNSSEC 2.1 might not have all keys purged from the HSM if instructed to do so. Since this is now done automatically this is worth pointing out that this was a bug and old keys will be permanently removed from the HSM.

Either when manually purging keys, or having
specified a in your key policy (kasp.xml), the keys are supposed
to be removed from the HSM. However, for some time, the keys were marked
for deletion, and became invisible, but the removal from the HSM was
skipped. In this release candidate this is fixed, but still allowing
keys not to be removed entirely. When you specify an automatic purge
then the keys will, after the specified period, will be completely
removed. When you purge manually, keys are not removed from the HSM
unless you specify an additional flag (the –delete or -d flag).

Special thanks to the people that help us in making OpenDNSSEC better
and better, mentioned in the NEWS file as always. Two of the bugs
were only traceable using this help.

The 2.1.8 release is available immediately from the download site.

Issues

  • OPENDNSSEC-954: Upgrade autoconf/automake configuration chain for version 2.69/1.16.2.
  • SUPPORT-261: Fix to crash when using ods-enforcer set-policy command.
  • OPENDNSSEC-953: Fix to crash in case zone file not present while getting a signconf update and state flush command.

    Thanks to Stefan Ubbink from SIDN for the co-operation in this fix.
  • OPENDNSSEC-951: Modify the purging of keys, to make it automatic to purge keys from the HSM.

    Thanks to Stefan Ubbink from SIDN for the co-operation in this fix.
  • OPENDNSSEC-950: Fix that caused crash when signer was offline for a prolonged period (but the enforcer wasn’t) in the middle of a ZSK roll.
  • OPENDNSSEC-952: memory leak in when receiving NOTIFY for non-existent zone (Thanks Sébastien Tisserant to for reporting).

Download

This entry was posted on Saturday, February 20th, 2021 at 23:50 and is filed under Uncategorized. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.

Comments are closed.