this post was submitted on 16 Feb 2024
146 points (99.3% liked)

Selfhosted

60426 readers
207 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
146
PSA: update your DNS resolvers (PiHole, unbound, Bind9, dsnmasq) to patch DNSSEC vulnerability (lemmy.blackeco.com)
submitted 2 years ago* (last edited 2 years ago) by BlackEco@lemmy.blackeco.com to c/selfhosted@lemmy.world
20 comments fedilink hide all child comments
 

Researchers recently found a vulnerability in the way DNS resolvers handle DNSSEC validation that allow attackers to DoS resolvers with a single DNS request

https://www.theregister.com/2024/02/13/dnssec_vulnerability_internet/

It is highly recommended to upgrade your resolvers to the following versions:

you are viewing a single comment's thread
view the rest of the comments
[–] Fedegenerate@lemmynsfw.com 3 points 2 years ago (2 children)

My unbound is on v1.13.1 (Raspbian) after update/upgrade. I've read it lags behind the main release by alot, should I trust the process that everything is fine.

[–] 9tr6gyp3@lemmy.world 11 points 2 years ago (2 children)

Its up to your distros package maintainer to make the patched version available. You can find who maintains it and contact them so they are aware.

[–] ARNiM@lemmy.world 4 points 2 years ago

Debian usually backports security fixes to older versions, so you may wanna check to Debian if they have an updated version of the package with the security fix.

This can be done by taking the CVE number related to this vulnerability and look at the package changelog.

[–] ChaoticEntropy@feddit.uk 1 points 2 years ago* (last edited 2 years ago) (1 children)

I'm on DietPi 9 and the latest version for Debian 12 is 1.17.1, sadly. Though I do see 1.19.1 is in testing as of today, according to Debian's package tracker site. Probably not worth trying to install an unstable version of it.

[–] Rooki@lemmy.world 2 points 2 years ago

I installed it now, it is working fine with my pihole. It wasnt that much of a hussle but a bit of googling.